Update definition of service.name and service.type

Closes elastic#142

CHANGELOG.md

@@ -22,6 +22,7 @@ All notable changes to this project will be documented in this file based on the
 * Make the following fields keyword: device.vendor, file.path, file.target_path, http.response.body, network.name, organization.name, url.href, url.path, url.query, user_agent.original. #137
   * Only two fields using `text` indexing at this time are `message` and `error.message`.
 * Rename `host.name` to `host.hostname` to better align with industry convention. #144
+* Update definition of `service.type` and `service.name`.
 
 ### Bugfixes
 

README.md

@@ -335,8 +335,8 @@ The service fields describe the service for or from which the data was collected
 | Field  | Description  | Type  | Multi Field  | Example  |
 |---|---|---|---|---|
 | <a name="service.id"></a>service.id  | Unique identifier of the running service.<br/>This id should uniquely identify this service. This makes it possible to correlate logs and metrics for one specific service.<br/>Example: If you are experiencing issues with one redis instance, you can filter on that id to see metrics and logs for that single instance.  | keyword  |   | `d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6`  |
-| <a name="service.name"></a>service.name  | Name of the service data is collected from.<br/>The name can be used to group and correlate logs and metrics from one service.<br/>Example: If logs or metrics are collected from Redis, `service.name` would be `redis`.  | keyword  |   | `elasticsearch`  |
-| <a name="service.type"></a>service.type  | Service type.  | keyword  |   |   |
+| <a name="service.name"></a>service.name  | Name of the service data is collected from.<br/>The name of the service is normally user given. This allows if two instances of the same service are running on the same machine they can be differentiated by the `service.name`.<br/>Also it allows for distributed services that run on multiple hosts to correlate the related instances based on the name.<br/>In the case of Elasticsearch the service.name could contain the cluster name. For Beats the service.name is by default a copy of the `service.type` field if no name is specified.  | keyword  |   | `elasticsearch-metrics`  |
+| <a name="service.type"></a>service.type  | The type of the service data is collected from.<br/>The type can be used to group and correlate logs and metrics from one service type.<br/>Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`.  | keyword  |   | `elasticsearch`  |
 | <a name="service.state"></a>service.state  | Current state of the service.  | keyword  |   |   |
 | <a name="service.version"></a>service.version  | Version of the service the data was collected from.<br/>This allows to look at a data set only for a specific version of a service.  | keyword  |   | `3.2.4`  |
 | <a name="service.ephemeral_id"></a>service.ephemeral_id  | Ephemeral identifier of this service (if one exists).<br/>This id normally changes across restarts, but `service.id` does not.  | keyword  |   | `8a4f500f`  |

fields.yml

@@ -1008,21 +1008,33 @@
         - name: name
           level: core
           type: keyword
-          example: "elasticsearch"
+          example: "elasticsearch-metrics"
           description: >
             Name of the service data is collected from.
     
-            The name can be used to group and correlate logs and metrics from one
-            service.
+            The name of the service is normally user given. This allows if two
+            instances of the same service are running on the same machine
+            they can be differentiated by the `service.name`.
+
+            Also it allows for distributed services that run on multiple hosts to
+            correlate the related instances based on the name.
 
-            Example: If logs or metrics are collected from Redis, `service.name` would be
-            `redis`.
+            In the case of Elasticsearch the service.name could contain the cluster
+            name. For Beats the service.name is by default a copy of the `service.type`
+            field if no name is specified.
 
         - name: type
           level: core
           type: keyword
+          example: "elasticsearch"
           description: >
-            Service type.
+            The type of the service data is collected from.
+    
+            The type can be used to group and correlate logs and metrics from one
+            service type.
+
+            Example: If logs or metrics are collected from Elasticsearch, `service.type` would be
+            `elasticsearch`.
 
         - name: state
           level: core

schema.csv

@@ -109,9 +109,9 @@ process.ppid,long,0,
 process.title,keyword,0,
 service.ephemeral_id,keyword,0,8a4f500f
 service.id,keyword,0,d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6
-service.name,keyword,0,elasticsearch
+service.name,keyword,0,elasticsearch-metrics
 service.state,keyword,0,
-service.type,keyword,0,
+service.type,keyword,0,elasticsearch
 service.version,keyword,0,3.2.4
 source.domain,keyword,0,
 source.hostname,keyword,0,

schemas/service.yml

@@ -26,21 +26,33 @@
     - name: name
       level: core
       type: keyword
-      example: "elasticsearch"
+      example: "elasticsearch-metrics"
       description: >
         Name of the service data is collected from.
 
-        The name can be used to group and correlate logs and metrics from one
-        service.
+        The name of the service is normally user given. This allows if two
+        instances of the same service are running on the same machine
+        they can be differentiated by the `service.name`.
+
+        Also it allows for distributed services that run on multiple hosts to
+        correlate the related instances based on the name.
 
-        Example: If logs or metrics are collected from Redis, `service.name` would be
-        `redis`.
+        In the case of Elasticsearch the service.name could contain the cluster
+        name. For Beats the service.name is by default a copy of the `service.type`
+        field if no name is specified.
 
     - name: type
       level: core
       type: keyword
+      example: "elasticsearch"
       description: >
-        Service type.
+        The type of the service data is collected from.
+
+        The type can be used to group and correlate logs and metrics from one
+        service type.
+
+        Example: If logs or metrics are collected from Elasticsearch, `service.type` would be
+        `elasticsearch`.
 
     - name: state
       level: core