IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

› ›

Host Fields

edit

Host Fields

edit

A host is defined as a general computing instance.

ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.

Host Field Details

edit

Field	Description	Level
host.architecture	Operating system architecture. type: keyword example: `x86_64`	core
host.hostname	Hostname of the host. It normally contains what the `hostname` command returns on the host machine. type: keyword	core
host.id	Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. type: keyword	core
host.ip	Host ip address. type: ip	core
host.mac	Host mac address. type: keyword	core
host.name	Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. type: keyword	core
host.type	Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. type: keyword	core

Field Reuse

edit

Field sets that can be nested under Host

edit

Nested fields	Description
host.geo.*	Fields describing a location.
host.os.*	OS fields contain information about the operating system.
host.user.*	Fields to describe the user relevant to the event.

« Group Fields HTTP Fields »