enum AgentIdStatus { verified mismatch missing auth_metadata_missing } #'The agent fields contain the data about the software entity, if any, # that collects, detects, or observes events on a host, or takes measurements on # a host. # # Examples include Beats. Agents may also run on observers. ECS agent.* fields shall # be populated with details of the agent running on the host or observer where the # event happened or the measurement was taken.' type Agent implements BaseRecord @model { #'Date/time when the event originated. # # This is the date/time extracted from the event, typically representing when # the event was generated by the source. # # If the event source has no original timestamp, this value is typically populated # by the first time the event was received by the pipeline. # # Required field for all events.' timestamp : Time! #'Custom key/value pairs. # # Can be used to add meta information to events. Should not contain nested objects. # All values are stored as keyword. # # Example: '{"application": "foo-bar", "env": "production"}' labels : JSON # 'For log events the message field contains the log message, optimized # for viewing in a log viewer. # # For structured logs without an original message field, other fields can be # concatenated to form a human-readable summary of the event. # # If multiple messages exist, they can be combined into one message.' message: String # List of keywords used to tag each event. tags: [String] # Key-Value pairs representing vendor specific properties attributes: JSON #'Unique identifier of this agent (if one exists). # # Example: For Beats this would be beat.id.' id :ID! # 'Custom name of the agent. # # This is a name that can be given to an agent. This can be helpful if for example # two Filebeat instances are running on the same host but a human readable separation # is needed on which Filebeat instance data is coming from.' name :String description:String # 'Type of the agent. # # The agent type always stays the same and should be given by the agent used. # In case of Filebeat the agent would always be Filebeat also if two Filebeat # instances are run on the same machine.' type :String version :String #'Extended build information for the agent. # # This field is intended to contain any build information that a data source # may provide, no specific formatting is required.' buildOriginal : String #'Ephemeral identifier of this agent (if one exists). # # This id normally changes across restarts, but `agent.id` does not.' ephemeralId : String }