org.elasticsearch.hadoop.util.ecs.FieldNames Maven / Gradle / Ivy

Show more of this group Show more artifacts with this name
Show all versions of elasticsearch-spark-20_2.11 Show documentation
Elasticsearch Spark (for Spark 2.X)
There is a newer version: 8.14.2
Show newest version
/*
 * Licensed to Elasticsearch under one or more contributor
 * license agreements. See the NOTICE file distributed with
 * this work for additional information regarding copyright
 * ownership. Elasticsearch licenses this file to you under
 * the Apache License, Version 2.0 (the "License"); you may
 * not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *    http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

package org.elasticsearch.hadoop.util.ecs;

public final class FieldNames {

    private FieldNames() {
        // No instances
    }

    // Fields Used:

    // Base:
    // @timestamp - (date) Current time when event is passed in to handler
    public static final String FIELD_TIMESTAMP = "@timestamp";
    // tags - ([keyword]) User providable field
    public static final String FIELD_TAGS = "tags";
    // labels - (object{keyword}) User providable fields
    public static final String FIELD_LABELS = "labels";
    // message - (text) Concatenated message data. TBD
    public static final String FIELD_MESSAGE= "message";

    // Error:
    public static final String FIELD_ERROR = "error";
    // error.message - (text) Original error message.
    public static final String FIELD_ERROR_MESSAGE = "message";
    // error.code - (keyword) (TBD) Can this be the exception type?
    public static final String FIELD_ERROR_CODE = "code";

    // Event:
    public static final String FIELD_EVENT = "event";
    // event.category - (keyword) TBD should this just be "error"?
    public static final String FIELD_EVENT_CATEGORY = "category";
    // event.type - (keyword) type of error handler
    public static final String FIELD_EVENT_TYPE = "type";
    // event.module - (keyword) does this make sense?
    public static final String FIELD_EVENT_MODULE = "module";
    // event.raw - (keyword) This might end up being the stringafied original cause (json data/bulk entry/record info)
    public static final String FIELD_EVENT_RAW = "raw";
    // event.version - (keyword) version of ECS used.
    public static final String FIELD_EVENT_VERSION = "version";

    // Host:
    public static final String FIELD_HOST = "host";
    // host.name - (keyword) Can we get this easily?
    public static final String FIELD_HOST_NAME = "name";
    // host.ip - (ip) Could do a reverse lookup?
    public static final String FIELD_HOST_IP = "ip";
    // host.architecture - (keyword) Get this from Java (x86_64)
    public static final String FIELD_HOST_ARCHITECTURE = "architecture";

    // Host OS:
    public static final String FIELD_HOST_OS = "os";
    // host.os.name - (keyword) Get from Java. (Mac OS X)
    public static final String FIELD_HOST_OS_NAME = "name";
    // host.os.version - (keyword) Get from java (10.12.6)
    public static final String FIELD_HOST_OS_VERSION = "version";

    // host.timezone.offset.sec - (long) default timezone
    public static final String FIELD_HOST_TIMEZONE = "timezone";
    public static final String FIELD_HOST_TIMEZONE_OFFSET = "offset";
    public static final String FIELD_HOST_TIMEZONE_OFFSET_SEC = "sec";
}