Define field formats that were defined in Beats but not yet in ECS.

generated/beats/fields.ecs.yml

@@ -143,6 +143,7 @@
     - name: bytes
       level: core
       type: long
+      format: bytes
       description: Bytes sent from the client to the server.
       example: 184
     - name: domain
@@ -382,6 +383,7 @@
     - name: bytes
       level: core
       type: long
+      format: bytes
       description: Bytes sent from the destination to the source.
       example: 184
     - name: domain
@@ -609,6 +611,8 @@
     - name: duration
       level: core
       type: long
+      format: duration
+      input_format: nanoseconds
       description: 'Duration of the event in nanoseconds.
 
         If event.start and event.end are known this value should be the difference
@@ -1185,6 +1189,7 @@
     - name: bytes
       level: core
       type: long
+      format: bytes
       description: 'Total bytes transferred in both directions.
 
         If `source.bytes` and `destination.bytes` are known, `network.bytes` is their
@@ -1594,6 +1599,7 @@
     - name: bytes
       level: core
       type: long
+      format: bytes
       description: Bytes sent from the server to the client.
       example: 184
     - name: domain
@@ -1807,6 +1813,7 @@
     - name: bytes
       level: core
       type: long
+      format: bytes
       description: Bytes sent from the source to the destination.
       example: 184
     - name: domain

generated/ecs/fields_flat.yml

@@ -91,6 +91,7 @@ client.bytes:
   description: Bytes sent from the client to the server.
   example: 184
   flat_name: client.bytes
+  format: bytes
   level: core
   name: bytes
   short: Bytes sent from the client to the server.
@@ -421,6 +422,7 @@ destination.bytes:
   description: Bytes sent from the destination to the source.
   example: 184
   flat_name: destination.bytes
+  format: bytes
   level: core
   name: bytes
   short: Bytes sent from the destination to the source.
@@ -722,6 +724,8 @@ event.duration:
     If event.start and event.end are known this value should be the difference between
     the end and start time.'
   flat_name: event.duration
+  format: duration
+  input_format: nanoseconds
   level: core
   name: duration
   short: Duration of the event in nanoseconds.
@@ -1533,6 +1537,7 @@ network.bytes:
     sum.'
   example: 368
   flat_name: network.bytes
+  format: bytes
   level: core
   name: bytes
   short: Total bytes transferred in both directions.
@@ -2024,6 +2029,7 @@ server.bytes:
   description: Bytes sent from the server to the client.
   example: 184
   flat_name: server.bytes
+  format: bytes
   level: core
   name: bytes
   short: Bytes sent from the server to the client.
@@ -2319,6 +2325,7 @@ source.bytes:
   description: Bytes sent from the source to the destination.
   example: 184
   flat_name: source.bytes
+  format: bytes
   level: core
   name: bytes
   short: Bytes sent from the source to the destination.

generated/ecs/fields_nested.yml

@@ -178,6 +178,7 @@ client:
       description: Bytes sent from the client to the server.
       example: 184
       flat_name: client.bytes
+      format: bytes
       level: core
       name: bytes
       short: Bytes sent from the client to the server.
@@ -546,6 +547,7 @@ destination:
       description: Bytes sent from the destination to the source.
       example: 184
       flat_name: destination.bytes
+      format: bytes
       level: core
       name: bytes
       short: Bytes sent from the destination to the source.
@@ -886,6 +888,8 @@ event:
         If event.start and event.end are known this value should be the difference
         between the end and start time.'
       flat_name: event.duration
+      format: duration
+      input_format: nanoseconds
       level: core
       name: duration
       short: Duration of the event in nanoseconds.
@@ -1764,6 +1768,7 @@ network:
         sum.'
       example: 368
       flat_name: network.bytes
+      format: bytes
       level: core
       name: bytes
       short: Total bytes transferred in both directions.
@@ -2359,6 +2364,7 @@ server:
       description: Bytes sent from the server to the client.
       example: 184
       flat_name: server.bytes
+      format: bytes
       level: core
       name: bytes
       short: Bytes sent from the server to the client.
@@ -2677,6 +2683,7 @@ source:
       description: Bytes sent from the source to the destination.
       example: 184
       flat_name: source.bytes
+      format: bytes
       level: core
       name: bytes
       short: Bytes sent from the source to the destination.

schemas/client.yml

@@ -53,6 +53,7 @@
 
     # Metrics
     - name: bytes
+      format: bytes
       level: core
       type: long
       example: 184

schemas/destination.yml

@@ -51,6 +51,7 @@
 
     # Metrics
     - name: bytes
+      format: bytes
       level: core
       type: long
       example: 184

schemas/event.yml

@@ -143,6 +143,8 @@
     - name: duration
       level: core
       type: long
+      format: duration
+      input_format: nanoseconds
       short: Duration of the event in nanoseconds.
       description: >
         Duration of the event in nanoseconds.

schemas/network.yml

@@ -121,6 +121,7 @@
     - name: bytes
       level: core
       type: long
+      format: bytes
       short: Total bytes transferred in both directions.
       description: >
         Total bytes transferred in both directions.

schemas/server.yml

@@ -53,6 +53,7 @@
 
     # Metrics
     - name: bytes
+      format: bytes
       level: core
       type: long
       example: 184

schemas/source.yml

@@ -51,6 +51,7 @@
 
     # Metrics
     - name: bytes
+      format: bytes
       level: core
       type: long
       example: 184

scripts/generators/beats.py

@@ -28,7 +28,7 @@ def generate(ecs_nested, ecs_version):
 
 def fieldset_field_array(source_fields):
     allowed_keys = ['name', 'level', 'required', 'type', 'object_type',
-                    'ignore_above', 'multi_fields', 'format',
+                    'ignore_above', 'multi_fields', 'format', 'input_format',
                     'description', 'example']
     fields = []
     for nested_field_name in source_fields: