Specify MAC address format like this example 00-00-5E-00-53-23

Reasons for choosing this format: * IEEE 802 uses this format: https://en.wikipedia.org/wiki/MAC_address#Notational_conventions * IETF uses this format: https://tools.ietf.org/html/rfc7042 It is not yet clear if we should prefer upper or lowercase. I just went with uppercase for now because that is what the references above use. Reason for choosing 00-00-5E-00-53-23: It is in the range of unicast MAC addresses reserved for documentation as specified by: https://tools.ietf.org/html/rfc7042#section-2.1.2
elastic · Feb 11, 2021 · 0d4a296 · 0d4a296
1 parent 9e30a88
commit 0d4a296
Show file tree

Hide file tree

Showing 6 changed files with 42 additions and 3 deletions.
diff --git a/schemas/client.yml b/schemas/client.yml
@@ -48,19 +48,27 @@
     - name: mac
       level: core
       type: keyword
+      example: 00-00-5E-00-53-23
       description: >
         MAC address of the client.
 
+        The format from RFC 7042 should be used: Each octet (that is, 8-bit
+        byte) is represented by two [uppercase] hexadecimal digits giving the
+        value of the octet as an unsigned integer. Successive octets are
+        separated by a hyphen.
+
     - name: domain
       level: core
-      type: keyword
+      type: wildcard
+      beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`.
       description: >
         Client domain.
 
     - name: registered_domain
       level: extended
-      type: keyword
+      type: wildcard
       short: The highest registered client domain, stripped of the subdomain.
+      beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`.
       description: >
         The highest registered client domain, stripped of the subdomain.
 

diff --git a/schemas/destination.yml b/schemas/destination.yml
@@ -43,9 +43,15 @@
     - name: mac
       level: core
       type: keyword
+      example: 00-00-5E-00-53-23
       description: >
         MAC address of the destination.
 
+        The format from RFC 7042 should be used: Each octet (that is, 8-bit byte) is
+        represented by two [uppercase] hexadecimal digits giving the value of
+        the octet as an unsigned integer. Successive octets are separated by a
+        hyphen.
+
     - name: domain
       level: core
       type: keyword

diff --git a/schemas/host.yml b/schemas/host.yml
@@ -55,11 +55,18 @@
     - name: mac
       level: core
       type: keyword
+      example: 00-00-5E-00-53-23
       description: >
         Host mac addresses.
+
+        The format from RFC 7042 should be used: Each octet (that is, 8-bit byte) is
+        represented by two [uppercase] hexadecimal digits giving the value of
+        the octet as an unsigned integer. Successive octets are separated by a
+        hyphen.
       normalize:
         - array
 
+
     - name: type
       level: core
       type: keyword

diff --git a/schemas/observer.yml b/schemas/observer.yml
@@ -20,8 +20,14 @@
     - name: mac
       level: core
       type: keyword
+      example: 00-00-5E-00-53-23
       description: >
-        MAC addresses of the observer
+        MAC addresses of the observer.
+
+        The format from RFC 7042 should be used: Each octet (that is, 8-bit byte) is
+        represented by two [uppercase] hexadecimal digits giving the value of
+        the octet as an unsigned integer. Successive octets are separated by a
+        hyphen.
       normalize:
         - array
 

diff --git a/schemas/server.yml b/schemas/server.yml
@@ -48,9 +48,15 @@
     - name: mac
       level: core
       type: keyword
+      example: 00-00-5E-00-53-23
       description: >
         MAC address of the server.
 
+        The format from RFC 7042 should be used: Each octet (that is, 8-bit byte) is
+        represented by two [uppercase] hexadecimal digits giving the value of
+        the octet as an unsigned integer. Successive octets are separated by a
+        hyphen.
+
     - name: domain
       level: core
       type: keyword

diff --git a/schemas/source.yml b/schemas/source.yml
@@ -43,9 +43,15 @@
     - name: mac
       level: core
       type: keyword
+      example: 00-00-5E-00-53-23
       description: >
         MAC address of the source.
 
+        The format from RFC 7042 should be used: Each octet (that is, 8-bit byte) is
+        represented by two [uppercase] hexadecimal digits giving the value of
+        the octet as an unsigned integer. Successive octets are separated by a
+        hyphen.
+
     - name: domain
       level: core
       type: keyword