ecs

Documentation

Overview

ECS event mapping functions.

ECS specification.

Index

• Constants
• func Fingerprint(s string) string
• type Agent
• type Base
• type Ecs
• type Event
  • func MapEvent(log, src string) (e *Event, err error)
  • func (e *Event) Bytes(pty bool) (b []byte, err error)
• type Evt
• type File
• type Host
• type Process
• type User

Constants

const (
	Version = "8.11"
)

Functions

func Fingerprint

func Fingerprint(s string) string

Types

type Agent

type Agent struct {
	Type    string `ecs:"type"`
	Version string `ecs:"version"`
}

type Base

type Base struct {
	Timestamp time.Time              `ecs:"@timestamp"`
	Message   string                 `ecs:"message"`
	Tags      string                 `ecs:"tags"`
	Labels    map[string]interface{} `ecs:"labels"`
}

type Ecs

type Ecs struct {
	Version string `ecs:"version"`
}

type Event

type Event struct {
	Ecs     Ecs
	Agent   Agent
	File    File
	Base    Base
	Event   Evt
	Host    Host
	User    User
	Process Process
}

func MapEvent

func MapEvent(log, src string) (e *Event, err error)

func (*Event) Bytes

func (e *Event) Bytes(pty bool) (b []byte, err error)

type Evt

type Evt struct {
	Kind     string    `ecs:"kind"`
	Module   string    `ecs:"module"`
	Dataset  string    `ecs:"dataset"`
	Severity int64     `ecs:"severity"`
	ID       string    `ecs:"id"`
	Code     string    `ecs:"code"`
	Provider string    `ecs:"provider"`
	Timezone string    `ecs:"timezone"`
	Created  time.Time `ecs:"created"`
	Ingested time.Time `ecs:"ingested"`
	Original string    `ecs:"original"`
	Hash     string    `ecs:"hash"`
}

type File

type File struct {
	Name        string `ecs:"name"`
	Directory   string `ecs:"directory"`
	Extension   string `ecs:"extension"`
	DriveLetter string `ecs:"drive_letter"`
	Path        string `ecs:"path"`
	Type        string `ecs:"type"`
}

type Host

type Host struct {
	Hostname string `ecs:"hostname"`
	Name     string `ecs:"name"`
}

type Process

type Process struct {
	PID      int64 `ecs:"pid"`
	ThreadID int64 `ecs:"thread.id"`
}

type User

type User struct {
	ID string `ecs:"id"`
}