apache2.access.agent
| user_agent.original
|
apache2.access.body_sent.bytes
| http.response.body.bytes
|
apache2.access.geoip.city_name
| source.geo.city_name
|
apache2.access.geoip.continent_name
| source.geo.continent_name
|
apache2.access.geoip.country_iso_code
| source.geo.country_iso_code
|
apache2.access.geoip.location
| source.geo.location
|
apache2.access.geoip.region_iso_code
| source.geo.region_iso_code
|
apache2.access.geoip.region_name
| source.geo.region_name
|
apache2.access.http_version
| http.version
|
apache2.access.method
| http.request.method
|
apache2.access.referrer
| http.request.referrer
|
apache2.access.remote_ip
| source.address
|
apache2.access.response_code
| http.response.status_code
|
apache2.access.url
| url.original
|
apache2.access.user_agent.device
| user_agent.device.name
|
apache2.access.user_agent.major
| user_agent.version
|
apache2.access.user_agent.minor
| user_agent.version
|
apache2.access.user_agent.name
| user_agent.name
|
apache2.access.user_agent.original
| user_agent.original
|
apache2.access.user_agent.os
| user_agent.os.full_name
|
apache2.access.user_agent.os_major
| user_agent.os.version
|
apache2.access.user_agent.os_minor
| user_agent.os.version
|
apache2.access.user_agent.os_name
| user_agent.os.name
|
apache2.access.user_agent.os_patch
| user_agent.os.version
|
apache2.access.user_agent.patch
| user_agent.version
|
apache2.access.user_name
| user.name
|
apache2.error.client
| source.address
|
apache2.error.level
| log.level
|
apache2.error.message
| message
|
apache2.error.pid
| process.pid
|
apache2.error.tid
| process.thread.id
|
auditd.log.acct
| user.name
|
auditd.log.agid
| user.audit.group.id
|
auditd.log.arch
| host.architecture
|
auditd.log.auid
| user.audit.id
|
auditd.log.cmd
| process.args
|
auditd.log.comm
| process.name
|
auditd.log.dst
| destination.address
|
auditd.log.egid
| user.effective.group.id
|
auditd.log.euid
| user.effective.id
|
auditd.log.exe
| process.executable
|
auditd.log.fsgid
| user.filesystem.group.id
|
auditd.log.geoip.city_name
| source.geo.city_name
|
auditd.log.geoip.continent_name
| source.geo.continent_name
|
auditd.log.geoip.country_iso_code
| source.geo.country_iso_code
|
auditd.log.geoip.location
| source.geo.location
|
auditd.log.geoip.region_iso_code
| source.geo.region_iso_code
|
auditd.log.geoip.region_name
| source.geo.region_name
|
auditd.log.gid
| user.group.id
|
auditd.log.msg
| message
|
auditd.log.ogid
| user.owner.group.id
|
auditd.log.ouid
| user.owner.id
|
auditd.log.pid
| process.pid
|
auditd.log.ppid
| process.ppid
|
auditd.log.record_type
| event.action
|
auditd.log.res
| event.outcome
|
auditd.log.sgid
| user.saved.group.id
|
auditd.log.src
| source.address
|
auditd.log.suid
| user.saved.id
|
auditd.log.terminal
| user.terminal
|
auditd.log.uid
| user.id
|
beat.hostname
| agent.hostname
|
beat.name
| host.name
|
beat.timezone
| event.timezone
|
beat.version
| agent.version
|
docker.container.id
| container.id
|
docker.container.image
| container.image.name
|
docker.container.labels
| container.labels
|
docker.container.name
| container.name
|
elasticsearch.audit.origin_address
| source.ip
|
elasticsearch.audit.principal
| user.name
|
elasticsearch.audit.request_body
| http.request.body.content
|
elasticsearch.audit.uri
| url.original
|
elasticsearch.slowlog.took_millis
| event.duration
|
fileset.module
| event.module
|
haproxy.client.ip
| source.address
|
haproxy.client.port
| source.port
|
haproxy.destination.ip
| destination.ip
|
haproxy.destination.port
| destination.port
|
haproxy.geoip.city_name
| source.geo.city_name
|
haproxy.geoip.continent_name
| source.geo.continent_name
|
haproxy.geoip.country_iso_code
| source.geo.country_iso_code
|
haproxy.geoip.location
| source.geo.location
|
haproxy.geoip.region_iso_code
| source.geo.region_iso_code
|
haproxy.geoip.region_name
| source.geo.region_name
|
haproxy.http.request.time_active_ms
| event.duration
|
haproxy.http.response.status_code
| http.response.status_code
|
haproxy.pid
| process.pid
|
haproxy.process_name
| process.name
|
haproxy.total_waiting_time_ms
| event.duration
|
http.response.content_length
| http.response.body.bytes
|
http.response.elapsed_time
| event.duration
|
icinga.debug.message
| message
|
icinga.debug.severity
| log.level
|
icinga.main.message
| message
|
icinga.main.severity
| log.level
|
icinga.startup.message
| message
|
icinga.startup.severity
| log.level
|
iis.access.body_received.bytes
| http.request.body.bytes
|
iis.access.body_sent.bytes
| http.response.body.bytes
|
iis.access.geoip.city_name
| source.geo.city_name
|
iis.access.geoip.continent_name
| source.geo.continent_name
|
iis.access.geoip.country_iso_code
| source.geo.country_iso_code
|
iis.access.geoip.location
| source.geo.location
|
iis.access.geoip.region_iso_code
| source.geo.region_iso_code
|
iis.access.geoip.region_name
| source.geo.region_name
|
iis.access.hostname
| destination.domain
|
iis.access.method
| http.request.method
|
iis.access.port
| destination.port
|
iis.access.query_string
| url.query
|
iis.access.referrer
| http.request.referrer
|
iis.access.remote_ip
| source.address
|
iis.access.request_time_ms
| event.duration
|
iis.access.response_code
| http.response.status_code
|
iis.access.server_ip
| destination.address
|
iis.access.url
| url.path
|
iis.access.user_agent.device
| user_agent.device.name
|
iis.access.user_agent.major
| user_agent.version
|
iis.access.user_agent.minor
| user_agent.version
|
iis.access.user_agent.name
| user_agent.name
|
iis.access.user_agent.original
| user_agent.original
|
iis.access.user_agent.os
| user_agent.os.full_name
|
iis.access.user_agent.os_major
| user_agent.os.version
|
iis.access.user_agent.os_minor
| user_agent.os.version
|
iis.access.user_agent.os_name
| user_agent.os.name
|
iis.access.user_agent.os_patch
| user_agent.os.version
|
iis.access.user_agent.patch
| user_agent.version
|
iis.access.user_name
| user.name
|
iis.error.geoip.city_name
| source.geo.city_name
|
iis.error.geoip.continent_name
| source.geo.continent_name
|
iis.error.geoip.country_iso_code
| source.geo.country_iso_code
|
iis.error.geoip.location
| source.geo.location
|
iis.error.geoip.region_iso_code
| source.geo.region_iso_code
|
iis.error.geoip.region_name
| source.geo.region_name
|
iis.error.http_version
| http.version
|
iis.error.method
| http.request.method
|
iis.error.remote_ip
| source.address
|
iis.error.remote_port
| source.port
|
iis.error.response_code
| http.response.status_code
|
iis.error.server_ip
| destination.address
|
iis.error.server_port
| destination.port
|
iis.error.url
| url.original
|
kafka.log.level
| log.level
|
kafka.log.message
| message
|
kibana.log.meta.meta.statusCode
| http.response.status_code
|
kibana.log.meta.method
| http.request.method
|
kibana.log.meta.req.headers.referer
| http.request.referrer
|
kibana.log.meta.req.headers.user-agent
| user_agent.original
|
kibana.log.meta.req.referer
| http.request.referrer
|
kibana.log.meta.req.remoteAddress
| source.address
|
kibana.log.meta.req.url
| url.original
|
logstash.log.level
| log.level
|
logstash.log.message
| message
|
logstash.slowlog.level
| log.level
|
logstash.slowlog.took_in_nanos
| event.duration
|
meta.cloud.availability_zone
| cloud.availability_zone
|
meta.cloud.instance_id
| cloud.instance.id
|
meta.cloud.instance_name
| cloud.instance.name
|
meta.cloud.machine_type
| cloud.machine.type
|
meta.cloud.project_id
| cloud.project.id
|
meta.cloud.provider
| cloud.provider
|
meta.cloud.region
| cloud.region
|
mongodb.log.message
| message
|
mongodb.log.severity
| log.level
|
mysql.error.level
| log.level
|
mysql.error.message
| message
|
mysql.error.thread_id
| mysql.thread_id
|
mysql.slowlog.host
| source.domain
|
mysql.slowlog.id
| mysql.thread_id
|
mysql.slowlog.ip
| source.ip
|
mysql.slowlog.query_time.sec
| event.duration
|
mysql.slowlog.user
| user.name
|
nginx.access.agent
| user_agent.original
|
nginx.access.body_sent.bytes
| http.response.body.bytes
|
nginx.access.geoip.city_name
| source.geo.city_name
|
nginx.access.geoip.continent_name
| source.geo.continent_name
|
nginx.access.geoip.country_iso_code
| source.geo.country_iso_code
|
nginx.access.geoip.location
| source.geo.location
|
nginx.access.geoip.region_iso_code
| source.geo.region_iso_code
|
nginx.access.geoip.region_name
| source.geo.region_name
|
nginx.access.http_version
| http.version
|
nginx.access.method
| http.request.method
|
nginx.access.referrer
| http.request.referrer
|
nginx.access.remote_ip
| source.address
|
nginx.access.response_code
| http.response.status_code
|
nginx.access.url
| url.original
|
nginx.access.user_agent.device
| user_agent.device.name
|
nginx.access.user_agent.major
| user_agent.version
|
nginx.access.user_agent.minor
| user_agent.version
|
nginx.access.user_agent.name
| user_agent.name
|
nginx.access.user_agent.os
| user_agent.os.full_name
|
nginx.access.user_agent.os_major
| user_agent.os.version
|
nginx.access.user_agent.os_minor
| user_agent.os.version
|
nginx.access.user_agent.os_name
| user_agent.os.name
|
nginx.access.user_agent.os_patch
| user_agent.os.version
|
nginx.access.user_agent.patch
| user_agent.version
|
nginx.access.user_name
| user.name
|
nginx.error.level
| log.level
|
nginx.error.message
| message
|
nginx.error.pid
| process.pid
|
nginx.error.tid
| process.thread.id
|
offset
| log.offset
|
postgresql.log.duration
| event.duration
|
postgresql.log.level
| log.level
|
postgresql.log.message
| message
|
postgresql.log.thread_id
| process.pid
|
postgresql.log.timezone
| event.timezone
|
postgresql.log.user
| user.name
|
process.exe
| process.executable
|
read_timestamp
| event.created
|
redis.log.level
| log.level
|
redis.log.message
| message
|
redis.log.pid
| process.pid
|
source_ecs.geo.city_name
| source.geo.city_name
|
source_ecs.geo.continent_name
| source.geo.continent_name
|
source_ecs.geo.country_iso_code
| source.geo.country_iso_code
|
source_ecs.geo.location
| source.geo.location
|
source_ecs.geo.region_iso_code
| source.geo.region_iso_code
|
source_ecs.geo.region_name
| source.geo.region_name
|
source_ecs.ip
| source.ip
|
source_ecs.port
| source.port
|
suricata.eve.alert.action
| event.outcome
|
suricata.eve.alert.severity
| event.severity
|
suricata.eve.app_proto
| network.protocol
|
suricata.eve.dest_ip
| destination.ip
|
suricata.eve.dest_port
| destination.port
|
suricata.eve.fileinfo.filename
| file.path
|
suricata.eve.fileinfo.size
| file.size
|
suricata.eve.flow.bytes_toclient
| destination.bytes
|
suricata.eve.flow.bytes_toserver
| source.bytes
|
suricata.eve.flow.pkts_toclient
| destination.packets
|
suricata.eve.flow.pkts_toserver
| source.packets
|
suricata.eve.flow.start
| event.start
|
suricata.eve.http.hostname
| url.domain
|
suricata.eve.http.http_method
| http.request.method
|
suricata.eve.http.http_refer
| http.request.referrer
|
suricata.eve.http.http_user_agent
| user_agent.original
|
suricata.eve.http.length
| http.response.body.bytes
|
suricata.eve.http.status
| http.response.status_code
|
suricata.eve.http.url
| url.original
|
suricata.eve.proto
| network.transport
|
suricata.eve.src_ip
| source.ip
|
suricata.eve.src_port
| source.port
|
suricata.eve.timestamp
| @timestamp
|
system.auth.groupadd.gid
| group.id
|
system.auth.groupadd.name
| group.name
|
system.auth.hostname
| host.hostname
|
system.auth.message
| message
|
system.auth.pid
| process.pid
|
system.auth.program
| process.name
|
system.auth.ssh.geoip.city_name
| source.geo.city_name
|
system.auth.ssh.geoip.continent_name
| source.geo.continent_name
|
system.auth.ssh.geoip.country_iso_code
| source.geo.country_iso_code
|
system.auth.ssh.geoip.location
| source.geo.location
|
system.auth.ssh.geoip.region_iso_code
| source.geo.region_iso_code
|
system.auth.ssh.geoip.region_name
| source.geo.region_name
|
system.auth.ssh.ip
| source.ip
|
system.auth.ssh.port
| source.port
|
system.auth.timestamp
| @timestamp
|
system.auth.user
| user.name
|
system.auth.useradd.gid
| group.id
|
system.auth.useradd.name
| user.name
|
system.auth.useradd.uid
| user.id
|
system.syslog.hostname
| host.hostname
|
system.syslog.message
| message
|
system.syslog.pid
| process.pid
|
system.syslog.program
| process.name
|
traefik.access.agent
| user_agent.original
|
traefik.access.body_sent.bytes
| http.response.body.bytes
|
traefik.access.duration
| event.duration
|
traefik.access.geoip.city_name
| source.geo.city_name
|
traefik.access.geoip.continent_name
| source.geo.continent_name
|
traefik.access.geoip.country_iso_code
| source.geo.country_iso_code
|
traefik.access.geoip.location
| source.geo.location
|
traefik.access.geoip.region_iso_code
| source.geo.region_iso_code
|
traefik.access.geoip.region_name
| source.geo.region_name
|
traefik.access.http_version
| http.version
|
traefik.access.method
| http.request.method
|
traefik.access.referrer
| http.request.referrer
|
traefik.access.remote_ip
| source.address
|
traefik.access.response_code
| http.response.status_code
|
traefik.access.url
| url.original
|
traefik.access.user_agent.device
| user_agent.device.name
|
traefik.access.user_agent.major
| user_agent.version
|
traefik.access.user_agent.minor
| user_agent.version
|
traefik.access.user_agent.name
| user_agent.name
|
traefik.access.user_agent.original
| user_agent.original
|
traefik.access.user_agent.os
| user_agent.os.full_name
|
traefik.access.user_agent.os_major
| user_agent.os.version
|
traefik.access.user_agent.os_minor
| user_agent.os.version
|
traefik.access.user_agent.os_name
| user_agent.os.name
|
traefik.access.user_agent.os_patch
| user_agent.os.version
|
traefik.access.user_agent.patch
| user_agent.version
|
traefik.access.user_name
| user.name
|