File Fields

file.accessed

Last time the file was accessed.

Note that not all filesystems keep track of access time.

type: date

extended

file.created

File creation time.

Note that not all filesystems store the creation time.

type: date

extended

file.ctime

Last time the file attributes or metadata changed.

Note that changes to the file content will update mtime. This implies ctime will be adjusted at the same time, since mtime is an attribute of the file.

type: date

extended

file.device

Device that is the source of the file.

type: keyword

example: sda

extended

file.directory

Directory where the file is located.

type: keyword

example: /home/alice

extended

file.extension

File extension.

type: keyword

example: png

extended

file.gid

Primary group ID (GID) of the file.

type: keyword

example: 1001

extended

file.group

Primary group name of the file.

type: keyword

example: alice

extended

file.inode

Inode representing the file in the filesystem.

type: keyword

example: 256383

extended

file.mode

Mode of the file in octal representation.

type: keyword

example: 0640

extended

file.mtime

Last time the file content was modified.

type: date

extended

file.name

Name of the file including the extension, without the directory.

type: keyword

example: example.png

extended

file.owner

File owner’s username.

type: keyword

example: alice

extended

file.path

Full path to the file.

type: keyword

example: /home/alice/example.png

extended

file.size

File size in bytes.

Only relevant when file.type is "file".

type: long

example: 16384

extended

file.target_path

Target path for symlinks.

type: keyword

extended

file.type

File type (file, dir, or symlink).

type: keyword

example: file

extended

file.uid

The user ID (UID) or security identifier (SID) of the file owner.

type: keyword

example: 1001

extended

file.hash.*

Hashes, usually file hashes.