What is an Elastic integration?

This integration is powered by Elastic Agent. Elastic Agent is a single, unified way to add monitoring for logs, metrics, and other types of data to a host. It can also protect hosts from security threats, query data from operating systems, forward data from remote services or hardware, and more. Refer to our documentation for a detailed comparison between Beats and Elastic Agent.

Prefer to use Beats for this use case? See Filebeat modules for logs or Metricbeat modules for metrics.

Overview

Logs

The s3access dataset collects server access logs from AWS S3. Server access logging provides detailed records for the requests that are made to a bucket. Server access logs are useful for many applications. For example, access log information can be useful in security and access audits. It can also help users to learn about customer base and understand Amazon S3 bill.

Please follow how to enable server access logging for sending server access logs to S3 bucket.

Exported fields

FieldDescriptionType
@timestamp
Event timestamp.
date
aws.s3access.authentication_type
The type of request authentication used, AuthHeader for authentication headers, QueryString for query string (pre-signed URL) or a - for unauthenticated requests.
keyword
aws.s3access.bucket
The name of the bucket that the request was processed against.
keyword
aws.s3access.bucket_owner
The canonical user ID of the owner of the source bucket.
keyword
aws.s3access.bytes_sent
The number of response bytes sent, excluding HTTP protocol overhead, or "-" if zero.
long
aws.s3access.cipher_suite
The Secure Sockets Layer (SSL) cipher that was negotiated for HTTPS request or a - for HTTP.
keyword
aws.s3access.error_code
The Amazon S3 Error Code, or "-" if no error occurred.
keyword
aws.s3access.host_header
The endpoint used to connect to Amazon S3.
keyword
aws.s3access.host_id
The x-amz-id-2 or Amazon S3 extended request ID.
keyword
aws.s3access.http_status
The numeric HTTP status code of the response.
long
aws.s3access.key
The "key" part of the request, URL encoded, or "-" if the operation does not take a key parameter.
keyword
aws.s3access.object_size
The total size of the object in question.
long
aws.s3access.operation
The operation listed here is declared as SOAP.operation, REST.HTTP_method.resource_type, WEBSITE.HTTP_method.resource_type, or BATCH.DELETE.OBJECT.
keyword
aws.s3access.referrer
The value of the HTTP Referrer header, if present.
keyword
aws.s3access.remote_ip
The apparent internet address of the requester.
ip
aws.s3access.request_id
A string generated by Amazon S3 to uniquely identify each request.
keyword
aws.s3access.request_uri
The Request-URI part of the HTTP request message.
keyword
aws.s3access.requester
The canonical user ID of the requester, or a - for unauthenticated requests.
keyword
aws.s3access.signature_version
The signature version, SigV2 or SigV4, that was used to authenticate the request or a - for unauthenticated requests.
keyword
aws.s3access.tls_version
The Transport Layer Security (TLS) version negotiated by the client.
keyword
aws.s3access.total_time
The number of milliseconds the request was in flight from the server's perspective.
long
aws.s3access.turn_around_time
The number of milliseconds that Amazon S3 spent processing your request.
long
aws.s3access.user_agent
The value of the HTTP User-Agent header.
keyword
aws.s3access.version_id
The version ID in the request, or "-" if the operation does not take a versionId parameter.
keyword
client.address
Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain, depending on which one it is.
keyword
client.ip
IP address of the client (IPv4 or IPv6).
ip
client.user.id
Unique identifier of the user.
keyword
cloud.account.id
The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.
keyword
cloud.availability_zone
Availability zone in which this host is running.
keyword
cloud.image.id
Image ID for the cloud instance.
keyword
cloud.instance.id
Instance ID of the host machine.
keyword
cloud.instance.name
Instance name of the host machine.
keyword
cloud.machine.type
Machine type of the host machine.
keyword
cloud.project.id
Name of the project in Google Cloud.
keyword
cloud.provider
Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.
keyword
cloud.region
Region in which this host is running.
keyword
container.id
Unique container id.
keyword
container.image.name
Name of the image the container was built on.
keyword
container.labels
Image labels.
object
container.name
Container name.
keyword
data_stream.dataset
Data stream dataset.
constant_keyword
data_stream.namespace
Data stream namespace.
constant_keyword
data_stream.type
Data stream type.
constant_keyword
ecs.version
ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.
keyword
error.message
Error message.
match_only_text
event.action
The action captured by the event. This describes the information in the event. It is more specific than event.category. Examples are group-add, process-started, file-created. The value is normally defined by the implementer.
keyword
event.code
Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.
keyword
event.dataset
Event dataset
constant_keyword
event.duration
Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time.
long
event.id
Unique ID to describe the event.
keyword
event.kind
This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. event.kind gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not.
keyword
event.module
Event module
constant_keyword
event.outcome
This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. event.outcome simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of event.outcome, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with event.type:info, or any events for which an outcome does not make logical sense.
keyword
geo.city_name
City name.
keyword
geo.continent_name
Name of the continent.
keyword
geo.country_iso_code
Country ISO code.
keyword
geo.country_name
Country name.
keyword
geo.location
Longitude and latitude.
geo_point
geo.region_iso_code
Region ISO code.
keyword
geo.region_name
Region name.
keyword
host.architecture
Operating system architecture.
keyword
host.containerized
If the host is a container.
boolean
host.domain
Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.
keyword
host.hostname
Hostname of the host. It normally contains what the hostname command returns on the host machine.
keyword
host.id
Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of beat.name.
keyword
host.ip
Host ip addresses.
ip
host.mac
Host mac addresses.
keyword
host.name
Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.
keyword
host.os.build
OS build information.
keyword
host.os.codename
OS codename, if any.
keyword
host.os.family
OS family (such as redhat, debian, freebsd, windows).
keyword
host.os.kernel
Operating system kernel version as a raw string.
keyword
host.os.name
Operating system name, without the version.
keyword
host.os.name.text
Multi-field of host.os.name.
text
host.os.platform
Operating system platform (such centos, ubuntu, windows).
keyword
host.os.version
Operating system version as a raw string.
keyword
host.type
Type of host. For Cloud providers this can be the machine type like t2.medium. If vm, this could be the container, for example, or other information meaningful in your environment.
keyword
http.request.method
HTTP request method. The value should retain its casing from the original event. For example, GET, get, and GeT are all considered valid values for this field.
keyword
http.request.referrer
Referrer for this HTTP request.
keyword
http.response.body.bytes
Size in bytes of the response body.
long
http.response.status_code
HTTP response status code.
long
http.version
HTTP version.
keyword
related.ip
All of the IPs seen on your event.
ip
related.user
All the user names or other user identifiers seen on the event.
keyword
tags
List of keywords used to tag each event.
keyword
tls.cipher
String indicating the cipher used during the current connection.
keyword
tls.version
Numeric part of the version parsed from the original string.
keyword
tls.version_protocol
Normalized lowercase protocol name parsed from original string.
keyword
url.domain
Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the domain field. If the URL contains a literal IPv6 address enclosed by [ and ] (IETF RFC 2732), the [ and ] characters should also be captured in the domain field.
keyword
url.extension
The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").
keyword
url.original
Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not.
wildcard
url.original.text
Multi-field of url.original.
match_only_text
url.path
Path of the request, such as "/search".
wildcard
url.query
The query field describes the query string of the request, such as "q=elasticsearch". The ? is excluded from the query string. If a URL contains no ?, there is no query field. If there is a ? but no query, the query field exists with an empty string. The exists query can be used to differentiate between the two cases.
keyword
url.scheme
Scheme of the request, such as "https". Note: The : is not part of the scheme.
keyword
user_agent.device.name
Name of the device.
keyword
user_agent.name
Name of the user agent.
keyword
user_agent.original
Unparsed user_agent string.
keyword
user_agent.original.text
Multi-field of user_agent.original.
match_only_text
user_agent.os.full
Operating system name, including the version or code name.
keyword
user_agent.os.full.text
Multi-field of user_agent.os.full.
match_only_text
user_agent.os.name
Operating system name, without the version.
keyword
user_agent.os.name.text
Multi-field of user_agent.os.name.
match_only_text
user_agent.os.version
Operating system version as a raw string.
keyword
user_agent.version
Version of the user agent.
keyword

An example event for s3access looks as following:

{
    "@timestamp": "2021-11-26T14:44:27.652Z",
    "data_stream": {
        "namespace": "default",
        "type": "logs",
        "dataset": "aws.s3access"
    },
    "url": {
        "path": "/test-s3-ks/",
        "original": "/test-s3-ks/?location\u0026aws-account=627959692251",
        "query": "location\u0026aws-account=627959692251"
    },
    "tags": [
        "preserve_original_event"
    ],
    "geo": {
        "continent_name": "North America",
        "region_iso_code": "US-VA",
        "city_name": "Ashburn",
        "country_iso_code": "US",
        "country_name": "United States",
        "region_name": "Virginia",
        "location": {
            "lon": -77.4728,
            "lat": 39.0481
        }
    },
    "cloud": {
        "provider": "aws"
    },
    "ecs": {
        "version": "8.0.0"
    },
    "related": {
        "user": [
            "36c1f05b76016b78528454e6e0c60e2b7ff7aa20c0a5e4c748276e5b0a2debd2"
        ],
        "ip": [
            "72.21.217.31"
        ]
    },
    "http": {
        "request": {
            "method": "GET"
        },
        "version": "1.1",
        "response": {
            "body": {
                "bytes": 142
            },
            "status_code": 200
        }
    },
    "client": {
        "user": {
            "id": "arn:aws:sts::123456:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_627959692251_784ab70b-8cc9-4d37-a2ec-2ff4d0c08af9"
        },
        "address": "72.21.217.31",
        "ip": "72.21.217.31"
    },
    "tls": {
        "cipher": "ECDHE-RSA-AES128-SHA",
        "version": "1.2",
        "version_protocol": "tls"
    },
    "event": {
        "duration": 17000000,
        "ingested": "2021-07-19T21:47:05.259665700Z",
        "original": "36c1f05b76016b78528454e6e0c60e2b7ff7aa20c0a5e4c748276e5b0a2debd2 test-s3-ks [01/Aug/2019:00:24:41 +0000] 72.21.217.31 arn:aws:sts::123456:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_627959692251_784ab70b-8cc9-4d37-a2ec-2ff4d0c08af9 44EE8651683CB4DA REST.GET.LOCATION - \"GET /test-s3-ks/?location\u0026aws-account=627959692251 HTTP/1.1\" 200 - 142 - 17 - \"-\" \"AWS-Support-TrustedAdvisor, aws-internal/3 aws-sdk-java/1.11.590 Linux/4.9.137-0.1.ac.218.74.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.212-b03 java/1.8.0_212 vendor/Oracle_Corporation\" - BsCfJedfuSnds2QFoxi+E/O7M6OEWzJnw4dUaes/2hyA363sONRJKzB7EOY+Bt9DTHYUn+HoHxI= SigV4 ECDHE-RSA-AES128-SHA AuthHeader s3.ap-southeast-1.amazonaws.com TLSv1.2",
        "kind": "event",
        "action": "REST.GET.LOCATION",
        "id": "44EE8651683CB4DA",
        "category": "web",
        "type": [
            "access"
        ],
        "outcome": "success"
    },
    "aws": {
        "s3access": {
            "requester": "arn:aws:sts::123456:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_627959692251_784ab70b-8cc9-4d37-a2ec-2ff4d0c08af9",
            "tls_version": "TLSv1.2",
            "signature_version": "SigV4",
            "bytes_sent": 142,
            "authentication_type": "AuthHeader",
            "request_uri": "GET /test-s3-ks/?location\u0026aws-account=627959692251 HTTP/1.1",
            "host_id": "BsCfJedfuSnds2QFoxi+E/O7M6OEWzJnw4dUaes/2hyA363sONRJKzB7EOY+Bt9DTHYUn+HoHxI=",
            "host_header": "s3.ap-southeast-1.amazonaws.com",
            "bucket": "test-s3-ks",
            "remote_ip": "72.21.217.31",
            "cipher_suite": "ECDHE-RSA-AES128-SHA",
            "http_status": 200,
            "total_time": 17,
            "bucket_owner": "36c1f05b76016b78528454e6e0c60e2b7ff7aa20c0a5e4c748276e5b0a2debd2",
            "operation": "REST.GET.LOCATION",
            "request_id": "44EE8651683CB4DA",
            "user_agent": "AWS-Support-TrustedAdvisor, aws-internal/3 aws-sdk-java/1.11.590 Linux/4.9.137-0.1.ac.218.74.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.212-b03 java/1.8.0_212 vendor/Oracle_Corporation"
        }
    },
    "user_agent": {
        "name": "aws-sdk-java",
        "original": "AWS-Support-TrustedAdvisor, aws-internal/3 aws-sdk-java/1.11.590 Linux/4.9.137-0.1.ac.218.74.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.212-b03 java/1.8.0_212 vendor/Oracle_Corporation",
        "os": {
            "name": "Linux",
            "version": "4.9.137",
            "full": "Linux 4.9.137"
        },
        "device": {
            "name": "Other"
        },
        "version": "1.11.590"
    }
}

Metrics

s3_daily_storage

An example event for s3_daily_storage looks as following:

{
    "@timestamp": "2022-07-25T19:02:00.000Z",
    "agent": {
        "name": "docker-fleet-agent",
        "id": "2d4b09d0-cdb6-445e-ac3f-6415f87b9864",
        "ephemeral_id": "9ef87976-bec2-4a74-9876-4e76d42035bb",
        "type": "metricbeat",
        "version": "8.3.2"
    },
    "elastic_agent": {
        "id": "2d4b09d0-cdb6-445e-ac3f-6415f87b9864",
        "version": "8.3.2",
        "snapshot": false
    },
    "cloud": {
        "provider": "aws",
        "region": "eu-central-1",
        "account": {
            "name": "elastic-beats",
            "id": "428152502467"
        }
    },
    "ecs": {
        "version": "8.0.0"
    },
    "service": {
        "type": "aws"
    },
    "data_stream": {
        "namespace": "default",
        "type": "metrics",
        "dataset": "aws.s3_daily_storage"
    },
    "metricset": {
        "period": 86400000,
        "name": "cloudwatch"
    },
    "aws": {
        "s3": {
            "bucket": {
                "name": "filebeat-aws-elb-test"
            }
        },
        "cloudwatch": {
            "namespace": "AWS/S3"
        },
        "s3_daily_storage": {
            "bucket": {
                "size": {
                    "bytes": 469407687
                }
            }
        },
        "dimensions": {
            "StorageType": "StandardStorage"
        }
    },
    "event": {
        "duration": 9553539400,
        "agent_id_status": "verified",
        "ingested": "2022-07-26T19:02:17Z",
        "module": "aws",
        "dataset": "aws.s3_daily_storage"
    }
}

Exported fields

FieldDescriptionType
@timestamp
Event timestamp.
date
aws.cloudwatch.namespace
The namespace specified when query cloudwatch api.
keyword
aws.dimensions.*
Metric dimensions.
object
aws.dimensions.BucketName
This dimension filters the data you request for the identified bucket only.
keyword
aws.dimensions.FilterId
This dimension filters metrics configurations that you specify for request metrics on a bucket, for example, a prefix or a tag.
keyword
aws.dimensions.StorageType
This dimension filters the data that you have stored in a bucket by types of storage.
keyword
aws.s3.bucket.name
Name of a S3 bucket.
keyword
aws.s3_daily_storage.bucket.size.bytes
The amount of data in bytes stored in a bucket.
long
aws.s3_daily_storage.number_of_objects
The total number of objects stored in a bucket for all storage classes.
long
aws.tags.*
Tag key value pairs from aws resources.
object
cloud
Fields related to the cloud or infrastructure the events are coming from.
group
cloud.account.id
The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.
keyword
cloud.account.name
The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name.
keyword
cloud.availability_zone
Availability zone in which this host is running.
keyword
cloud.image.id
Image ID for the cloud instance.
keyword
cloud.instance.id
Instance ID of the host machine.
keyword
cloud.instance.name
Instance name of the host machine.
keyword
cloud.machine.type
Machine type of the host machine.
keyword
cloud.project.id
Name of the project in Google Cloud.
keyword
cloud.provider
Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.
keyword
cloud.region
Region in which this host, resource, or service is located.
keyword
container.id
Unique container id.
keyword
container.image.name
Name of the image the container was built on.
keyword
container.labels
Image labels.
object
container.name
Container name.
keyword
data_stream.dataset
Data stream dataset.
constant_keyword
data_stream.namespace
Data stream namespace.
constant_keyword
data_stream.type
Data stream type.
constant_keyword
ecs.version
ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.
keyword
error
These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error.
group
error.message
Error message.
match_only_text
event.dataset
Event dataset
constant_keyword
event.module
Event module
constant_keyword
host.architecture
Operating system architecture.
keyword
host.containerized
If the host is a container.
boolean
host.domain
Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.
keyword
host.hostname
Hostname of the host. It normally contains what the hostname command returns on the host machine.
keyword
host.id
Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of beat.name.
keyword
host.ip
Host ip addresses.
ip
host.mac
Host mac addresses.
keyword
host.name
Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.
keyword
host.os.build
OS build information.
keyword
host.os.codename
OS codename, if any.
keyword
host.os.family
OS family (such as redhat, debian, freebsd, windows).
keyword
host.os.kernel
Operating system kernel version as a raw string.
keyword
host.os.name
Operating system name, without the version.
keyword
host.os.name.text
Multi-field of host.os.name.
text
host.os.platform
Operating system platform (such centos, ubuntu, windows).
keyword
host.os.version
Operating system version as a raw string.
keyword
host.type
Type of host. For Cloud providers this can be the machine type like t2.medium. If vm, this could be the container, for example, or other information meaningful in your environment.
keyword
service.type
The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, service.type would be elasticsearch.
keyword

s3_request

An example event for s3_request looks as following:

{
    "@timestamp": "2022-07-26T20:10:00.000Z",
    "agent": {
        "name": "docker-fleet-agent",
        "id": "2d4b09d0-cdb6-445e-ac3f-6415f87b9864",
        "type": "metricbeat",
        "ephemeral_id": "287cb701-3031-45be-a8c1-4c4860603d9b",
        "version": "8.3.2"
    },
    "elastic_agent": {
        "id": "2d4b09d0-cdb6-445e-ac3f-6415f87b9864",
        "version": "8.3.2",
        "snapshot": false
    },
    "cloud": {
        "provider": "aws",
        "region": "us-east-1",
        "account": {
            "name": "elastic-beats",
            "id": "428152502467"
        }
    },
    "ecs": {
        "version": "8.0.0"
    },
    "service": {
        "type": "aws"
    },
    "data_stream": {
        "namespace": "default",
        "type": "metrics",
        "dataset": "aws.s3_request"
    },
    "metricset": {
        "period": 60000,
        "name": "cloudwatch"
    },
    "aws": {
        "s3": {
            "bucket": {
                "name": "vpc-flow-logs-ks"
            }
        },
        "cloudwatch": {
            "namespace": "AWS/S3"
        },
        "s3_request": {
            "latency": {
                "total_request": {
                    "ms": 32
                }
            },
            "requests": {
                "head": 1,
                "total": 1
            },
            "downloaded": {
                "bytes": 400
            },
            "errors": {
                "4xx": 1,
                "5xx": 0
            }
        },
        "dimensions": {
            "FilterId": "AllItems"
        }
    },
    "event": {
        "duration": 9552028500,
        "agent_id_status": "verified",
        "ingested": "2022-07-26T20:16:31Z",
        "module": "aws",
        "dataset": "aws.s3_request"
    }
}

Exported fields

FieldDescriptionType
@timestamp
Event timestamp.
date
aws.cloudwatch.namespace
The namespace specified when query cloudwatch api.
keyword
aws.dimensions.*
Metric dimensions.
object
aws.dimensions.BucketName
This dimension filters the data you request for the identified bucket only.
keyword
aws.dimensions.FilterId
This dimension filters metrics configurations that you specify for request metrics on a bucket, for example, a prefix or a tag.
keyword
aws.dimensions.StorageType
This dimension filters the data that you have stored in a bucket by types of storage.
keyword
aws.s3.bucket.name
Name of a S3 bucket.
keyword
aws.s3_request.downloaded.bytes
The number bytes downloaded for requests made to an Amazon S3 bucket, where the response includes a body.
long
aws.s3_request.errors.4xx
The number of HTTP 4xx client error status code requests made to an Amazon S3 bucket with a value of either 0 or 1.
long
aws.s3_request.errors.5xx
The number of HTTP 5xx server error status code requests made to an Amazon S3 bucket with a value of either 0 or 1.
long
aws.s3_request.latency.first_byte.ms
The per-request time from the complete request being received by an Amazon S3 bucket to when the response starts to be returned.
long
aws.s3_request.latency.total_request.ms
The elapsed per-request time from the first byte received to the last byte sent to an Amazon S3 bucket.
long
aws.s3_request.requests.delete
The number of HTTP DELETE requests made for objects in an Amazon S3 bucket.
long
aws.s3_request.requests.get
The number of HTTP GET requests made for objects in an Amazon S3 bucket.
long
aws.s3_request.requests.head
The number of HTTP HEAD requests made to an Amazon S3 bucket.
long
aws.s3_request.requests.list
The number of HTTP requests that list the contents of a bucket.
long
aws.s3_request.requests.post
The number of HTTP POST requests made to an Amazon S3 bucket.
long
aws.s3_request.requests.put
The number of HTTP PUT requests made for objects in an Amazon S3 bucket.
long
aws.s3_request.requests.select
The number of Amazon S3 SELECT Object Content requests made for objects in an Amazon S3 bucket.
long
aws.s3_request.requests.select_returned.bytes
The number of bytes of data returned with Amazon S3 SELECT Object Content requests in an Amazon S3 bucket.
long
aws.s3_request.requests.select_scanned.bytes
The number of bytes of data scanned with Amazon S3 SELECT Object Content requests in an Amazon S3 bucket.
long
aws.s3_request.requests.total
The total number of HTTP requests made to an Amazon S3 bucket, regardless of type.
long
aws.s3_request.uploaded.bytes
The number bytes uploaded that contain a request body, made to an Amazon S3 bucket.
long
aws.tags.*
Tag key value pairs from aws resources.
object
cloud
Fields related to the cloud or infrastructure the events are coming from.
group
cloud.account.id
The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.
keyword
cloud.account.name
The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name.
keyword
cloud.availability_zone
Availability zone in which this host, resource, or service is located.
keyword
cloud.image.id
Image ID for the cloud instance.
keyword
cloud.instance.id
Instance ID of the host machine.
keyword
cloud.instance.name
Instance name of the host machine.
keyword
cloud.machine.type
Machine type of the host machine.
keyword
cloud.project.id
Name of the project in Google Cloud.
keyword
cloud.provider
Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.
keyword
cloud.region
Region in which this host, resource, or service is located.
keyword
container.id
Unique container id.
keyword
container.image.name
Name of the image the container was built on.
keyword
container.labels
Image labels.
object
container.name
Container name.
keyword
data_stream.dataset
Data stream dataset.
constant_keyword
data_stream.namespace
Data stream namespace.
constant_keyword
data_stream.type
Data stream type.
constant_keyword
ecs.version
ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.
keyword
error
These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error.
group
error.message
Error message.
match_only_text
event.dataset
Event dataset
constant_keyword
event.module
Event module
constant_keyword
host.architecture
Operating system architecture.
keyword
host.containerized
If the host is a container.
boolean
host.domain
Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.
keyword
host.hostname
Hostname of the host. It normally contains what the hostname command returns on the host machine.
keyword
host.id
Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of beat.name.
keyword
host.ip
Host ip addresses.
ip
host.mac
Host mac addresses.
keyword
host.name
Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.
keyword
host.os.build
OS build information.
keyword
host.os.codename
OS codename, if any.
keyword
host.os.family
OS family (such as redhat, debian, freebsd, windows).
keyword
host.os.kernel
Operating system kernel version as a raw string.
keyword
host.os.name
Operating system name, without the version.
keyword
host.os.name.text
Multi-field of host.os.name.
text
host.os.platform
Operating system platform (such centos, ubuntu, windows).
keyword
host.os.version
Operating system version as a raw string.
keyword
host.type
Type of host. For Cloud providers this can be the machine type like t2.medium. If vm, this could be the container, for example, or other information meaningful in your environment.
keyword
service.type
The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, service.type would be elasticsearch.
keyword