Re-introduce field formats on ECS fields.

They were accidentally removed by elastic#11150.

auditbeat/docs/fields.asciidoc

@@ -3066,6 +3066,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the client to the server.
 
 --
@@ -3445,6 +3447,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the destination to the source.
 
 --
@@ -3769,6 +3773,8 @@ The concept of a `dataset` (fileset / metricset) is used in Beats as a subset of
 --
 type: long
 
+format: duration
+
 Duration of the event in nanoseconds.
 If event.start and event.end are known this value should be the difference between the end and start time.
 
@@ -4646,6 +4652,8 @@ type: long
 
 example: 368
 
+format: bytes
+
 Total bytes transferred in both directions.
 If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum.
 
@@ -5235,6 +5243,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the server to the client.
 
 --
@@ -5549,6 +5559,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the source to the destination.
 
 --

filebeat/docs/fields.asciidoc

@@ -1323,6 +1323,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the client to the server.
 
 --
@@ -1702,6 +1704,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the destination to the source.
 
 --
@@ -2026,6 +2030,8 @@ The concept of a `dataset` (fileset / metricset) is used in Beats as a subset of
 --
 type: long
 
+format: duration
+
 Duration of the event in nanoseconds.
 If event.start and event.end are known this value should be the difference between the end and start time.
 
@@ -2903,6 +2909,8 @@ type: long
 
 example: 368
 
+format: bytes
+
 Total bytes transferred in both directions.
 If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum.
 
@@ -3492,6 +3500,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the server to the client.
 
 --
@@ -3806,6 +3816,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the source to the destination.
 
 --

heartbeat/docs/fields.asciidoc

@@ -489,6 +489,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the client to the server.
 
 --
@@ -868,6 +870,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the destination to the source.
 
 --
@@ -1192,6 +1196,8 @@ The concept of a `dataset` (fileset / metricset) is used in Beats as a subset of
 --
 type: long
 
+format: duration
+
 Duration of the event in nanoseconds.
 If event.start and event.end are known this value should be the difference between the end and start time.
 
@@ -2069,6 +2075,8 @@ type: long
 
 example: 368
 
+format: bytes
+
 Total bytes transferred in both directions.
 If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum.
 
@@ -2658,6 +2666,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the server to the client.
 
 --
@@ -2972,6 +2982,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the source to the destination.
 
 --

journalbeat/docs/fields.asciidoc

@@ -1066,6 +1066,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the client to the server.
 
 --
@@ -1445,6 +1447,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the destination to the source.
 
 --
@@ -1769,6 +1773,8 @@ The concept of a `dataset` (fileset / metricset) is used in Beats as a subset of
 --
 type: long
 
+format: duration
+
 Duration of the event in nanoseconds.
 If event.start and event.end are known this value should be the difference between the end and start time.
 
@@ -2646,6 +2652,8 @@ type: long
 
 example: 368
 
+format: bytes
+
 Total bytes transferred in both directions.
 If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum.
 
@@ -3235,6 +3243,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the server to the client.
 
 --
@@ -3549,6 +3559,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the source to the destination.
 
 --

libbeat/_meta/fields.ecs.yml

@@ -143,6 +143,7 @@
     - name: bytes
       level: core
       type: long
+      format: bytes
       description: Bytes sent from the client to the server.
       example: 184
     - name: domain
@@ -382,6 +383,7 @@
     - name: bytes
       level: core
       type: long
+      format: bytes
       description: Bytes sent from the destination to the source.
       example: 184
     - name: domain
@@ -609,6 +611,8 @@
     - name: duration
       level: core
       type: long
+      format: duration
+      input_format: nanoseconds
       description: 'Duration of the event in nanoseconds.
 
         If event.start and event.end are known this value should be the difference
@@ -1185,6 +1189,7 @@
     - name: bytes
       level: core
       type: long
+      format: bytes
       description: 'Total bytes transferred in both directions.
 
         If `source.bytes` and `destination.bytes` are known, `network.bytes` is their
@@ -1594,6 +1599,7 @@
     - name: bytes
       level: core
       type: long
+      format: bytes
       description: Bytes sent from the server to the client.
       example: 184
     - name: domain
@@ -1807,6 +1813,7 @@
     - name: bytes
       level: core
       type: long
+      format: bytes
       description: Bytes sent from the source to the destination.
       example: 184
     - name: domain

metricbeat/docs/fields.asciidoc

@@ -4696,6 +4696,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the client to the server.
 
 --
@@ -5075,6 +5077,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the destination to the source.
 
 --
@@ -5399,6 +5403,8 @@ The concept of a `dataset` (fileset / metricset) is used in Beats as a subset of
 --
 type: long
 
+format: duration
+
 Duration of the event in nanoseconds.
 If event.start and event.end are known this value should be the difference between the end and start time.
 
@@ -6276,6 +6282,8 @@ type: long
 
 example: 368
 
+format: bytes
+
 Total bytes transferred in both directions.
 If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum.
 
@@ -6865,6 +6873,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the server to the client.
 
 --
@@ -7179,6 +7189,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the source to the destination.
 
 --

packetbeat/docs/fields.asciidoc

@@ -2391,6 +2391,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the client to the server.
 
 --
@@ -2770,6 +2772,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the destination to the source.
 
 --
@@ -3094,6 +3098,8 @@ The concept of a `dataset` (fileset / metricset) is used in Beats as a subset of
 --
 type: long
 
+format: duration
+
 Duration of the event in nanoseconds.
 If event.start and event.end are known this value should be the difference between the end and start time.
 
@@ -3971,6 +3977,8 @@ type: long
 
 example: 368
 
+format: bytes
+
 Total bytes transferred in both directions.
 If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum.
 
@@ -4560,6 +4568,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the server to the client.
 
 --
@@ -4874,6 +4884,8 @@ type: long
 
 example: 184
 
+format: bytes
+
 Bytes sent from the source to the destination.
 
 --