- Added
http.request.id
. #1208 - Added
cloud.service.name
. #1204 - Added
hash.ssdeep
. #1169
- Clean up
event.reference
description. #1181
- Added
event.category
"registry". #1040 - Added
event.category
"session". #1049 - Added usage documentation for
user
fields. #1066 - Added
user
fields atuser.effective.*
,user.target.*
anduser.changes.*
. #1066 - Added
os.type
. #1111
- Event categorization fields GA. #1067
wildcard
field type adoption. #1098- Note
[
and]
bracket characters may enclose a literal IPv6 address when populatingurl.domain
. #1131 - Reinforce the exclusion of the leading dot from
url.extension
. #1151
- Deprecated
host.user.*
fields for removal at the next major. #1066
tracing
fields should be at root of Beatsfields.ecs.yml
artifacts. #1164
- Added ability to supply free-form usage documentation per fieldset. #988
- Added the
path
key when type isalias
, to support the alias field type. #877 - Added support for
scaled_float
's mandatory parameterscaling_factor
. #1042 - Added ability for --oss flag to fall back
constant_keyword
tokeyword
. #1046 - Added support in the generated Go source go for
wildcard
,version
, andconstant_keyword
data types. #1050 - Added support for marking fields, field sets, or field reuse as beta in the documentation. #1051
- Added support for
constant_keyword
's optional parametervalue
. #1112 - Added component templates for ECS field sets. #1156, #1186, #1191
- Added functionality for merging custom and core multi-fields. #982
- Make all fields linkable directly. #1148
- Added a notice highlighting that the
tracing
fields are not nested under the namespacetracing.
#1162 - ES 6.x template data types will fallback to supported types. #1171, #1176, #1186
- Add a documentation page discussing the experimental artifacts. #1189