
////
This file is generated! See scripts/generate_template.py --docs
////

[[exported-fields]]
== Exported Fields

These are the fields exported by the logging system and available for searching
from Elasticsearch and Kibana.  Use the full, dotted field name when searching.
For example, for an Elasticsearch /_search URL, to look for a Kubernetes pod name,
use `/_search/q=kubernetes.pod_name:name-of-my-pod`
This document describes fields that may not be present in your logging store.
Not all of these fields are present in every record.
The fields are grouped in the following categories:

* <<exported-fields-Default>>
* <<exported-fields-collectd>>
* <<exported-fields-pipeline_metadata>>
* <<exported-fields-kubernetes>>


'''
[[exported-fields-Default]]
=== [big]*Top Level Fields*

The top level fields are common to every application, and may be present in every record.
For the Elasticsearch template, this is what populates the actual mappings
of either the `\_default_` type (in ES 5.x or earlier) or the only single `_doc` type (in ES 6.x or later)
in the template's mapping section.

Read more about Elasticsearch index types deprecation:

- https://www.elastic.co/guide/en/elasticsearch/reference/6.0/default-mapping.html[Default mapping deprecation in ES 6.x]
- https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html[Removal of mappings types in ES 6.x]



==== @timestamp

type: date

example: 2015-01-24 14:06:05.071000+00:00

format: yyyy-MM-dd HH:mm:ss,SSSZ||yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ||yyyy-MM-dd'T'HH:mm:ssZ||dateOptionalTime

UTC value marking when the log payload was created, or when log payload was first collected if the creation time is not known;
this is the log processing pipeline’s “best effort” determination of when the log payload was generated
FYI: the “@” prefix convention to note a field as being reserved for a particular use; in this case, most tools by default look for “@timestamp” with ElasticSearch


==== geoip

type: object

geo-ip of the machine


==== hostname

type: keyword

FQDN of the entity generating the original payload.  This field is a best effort attempt to derive this context; sometimes the entity generating it knows it; other times that entity has a restricted namespace itself, and the collector or normalizer knows that.


==== ipaddr4

type: ip

IP address v4 of the source server. Can be an array.


==== ipaddr6

type: ip

IP address v6 of the source server (if available). Can be an array.


==== level

type: keyword

example: info

Logging level as provided by: rsyslog(severitytext property), python's
logging module, etc.
Possible values are as listed here: http://sourceware.org/git/?p=glibc.git;a=blob;f=misc/sys/syslog.h;h=ee01478c4b19a954426a96448577c5a76e6647c0;hb=HEAD#l74 plus `trace` and `unknown`
That is: alert crit debug emerg err info notice trace unknown warning
Note that `trace` isn't in the syslog.h list but many applications use it
`unknown` is only used when the logging system gets a value it doesn't understand
`unknown` is the highest level
`trace` should be considered as higher (more verbose) than `debug`
`error` should be converted to `err`
`panic` should be converted to `emerg`
`warn` should be converted to `warning`
Numeric values from syslog/journal PRIORITY can usually be mapped using the priority values as listed here:
http://sourceware.org/git/?p=glibc.git;a=blob;f=misc/sys/syslog.h;h=ee01478c4b19a954426a96448577c5a76e6647c0;hb=HEAD#l51
That is, 0 -> emerg, 1 -> alert, ..., 7 -> debug, 8 -> trace, 9 -> unknown
Log levels/priorities from other logging systems should be mapped to the nearest match
For example, from python logging: https://docs.python.org/2.7/library/logging.html#logging-levels
CRITICAL -> crit, ERROR -> err, ...., DEBUG -> debug


==== message

type: text

example: TODO

Typical log entry message, or payload, possibly stripped of metadata pulled out of it by collector/normalizer, UTF-8 encoded.


==== pid

type: keyword

This is the process ID of the logging entity, if available.


==== service

type: keyword

Name of the service associated with the logging entity, if available. For example, syslog's APP-NAME and rsyslog's programname property are mapped to the service field.


==== tags

type: text

Optionally provided operator defined list of tags placed on each log by the collector or normalizer. The payload can be a string with whitespace-delimited string tokens, or a JSON list of string tokens.


==== file

type: text

Optional path to the file containing the log entry local to the collector TODO: analyzer for file paths


==== offset

type: long

The offset value can represent bytes to the start of the log line in the file (zero or one based), or log line numbers (zero or one based), so long as the values are strictly monotonically increasing in the context of a single log file. They values are allowed to wrap, representing a new version of the log file (rotation).


==== namespace_name

type: keyword

example: my-cool-project-in-lab04

format: [a-zA-Z][a-zA-Z0-9-]{0,61}[a-zA-Z0-9]

Associate this record with the namespace with this name.
This value will not be stored.  It is only used to associate the
record with the appropriate namespace for access control and
visualization.  Normally this value will be given in the tag, but if the
protocol does not support sending a tag, this field can be used.
If this field is present, it will override the
namespace given in the tag or in kubernetes.namespace_name.
The format is the same format used for Kubernetes namespace names.
See also namespace_uuid.


==== namespace_uuid

type: keyword

example: 82f13a8e-882a-4344-b103-f0a6f30fd218

format: [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}

The uuid associated with the namespace_name.
This value will not be stored.  It is only used to associate the
record with the appropriate namespace for access control and
visualization.  If this field is present, it will override the
uuid given in kubernetes.namespace_uuid.  This will also cause
the Kubernetes metadata lookup to be skipped for this log record.


==== viaq_msg_id

type: keyword

example: 82f13a8e-882a-4344-b103-f0a6f30fd218

A unique ID assigned to each message.  The format is not specified.
It may be a UUID or a Base64 or some other ascii value.
This is currently generated by
https://github.com/uken/fluent-plugin-elasticsearch/tree/v1.13.2#generate-hash-id
and is used as the `_id` of the document in Elasticsearch.
An intended use of this field is that if you use another logging
store or application other than Elasticsearch, but you still need
to correlate data with the data stored in Elasticsearch, this field
will give you the exact document corresponding to the record.


==== viaq_index_name

type: keyword

example: container.app-write

For Elasticsearch 6.x and later this is a name of a write index alias. The value depends on a log type
of this message. Detailed documentation is found at
https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model

For Elasticsearch 5.x and earlier an index name in which this message will be stored within the Elasticsearch.
The value of this field is generated based on the source of the message. Example of the value
is 'project.my-cool-project-in-lab04.748e92c2-70d7-11e9-b387-000d3af2d83b.2019.05.09'.



'''
[[exported-fields-collectd]]
=== [big]*collectd Fields*

Namespace metrics metadata.



==== collectd.interval

type: float

Collectd's interval.


==== collectd.plugin

type: keyword

Collectd's plugin.


==== collectd.plugin_instance

type: keyword

Collectd's plugin_instance.


==== collectd.type_instance

type: keyword

Collectd's type_instance.


==== collectd.type

type: keyword

Collectd's type.


==== collectd.dstypes

type: keyword

Collectd's dstypes.



'''
[[exported-fields-collectd.processes]]
=== [big]*collectd.processes Fields*

Corresponds to collectd's processes plugin.



==== collectd.processes.ps_state

type: long

collectd's ps_state type of processes plugin.



'''
[[exported-fields-collectd.processes.ps_disk_ops]]
=== [big]*collectd.processes.ps_disk_ops Fields*

collectd's ps_disk_ops type of processes plugin.



==== collectd.processes.ps_disk_ops.read

type: float

TODO


==== collectd.processes.ps_disk_ops.write

type: float

TODO


==== collectd.processes.ps_vm

type: long

collectd's ps_vm type of processes plugin.


==== collectd.processes.ps_rss

type: long

collectd's ps_rss type of processes plugin.


==== collectd.processes.ps_data

type: long

collectd's ps_data type of processes plugin.


==== collectd.processes.ps_code

type: long

collectd's ps_code type of processes plugin.


==== collectd.processes.ps_stacksize

type: long

collectd's ps_stacksize type of processes plugin.



'''
[[exported-fields-collectd.processes.ps_cputime]]
=== [big]*collectd.processes.ps_cputime Fields*

collectd's ps_cputime type of processes plugin.



==== collectd.processes.ps_cputime.user

type: float

TODO


==== collectd.processes.ps_cputime.syst

type: float

TODO



'''
[[exported-fields-collectd.processes.ps_count]]
=== [big]*collectd.processes.ps_count Fields*

collectd's ps_count type of processes plugin.



==== collectd.processes.ps_count.processes

type: long

TODO


==== collectd.processes.ps_count.threads

type: long

TODO



'''
[[exported-fields-collectd.processes.ps_pagefaults]]
=== [big]*collectd.processes.ps_pagefaults Fields*

collectd's ps_pagefaults type of processes plugin.



==== collectd.processes.ps_pagefaults.majflt

type: float

TODO


==== collectd.processes.ps_pagefaults.minflt

type: float

TODO



'''
[[exported-fields-collectd.processes.ps_disk_octets]]
=== [big]*collectd.processes.ps_disk_octets Fields*

collectd's ps_disk_octets type of processes plugin.



==== collectd.processes.ps_disk_octets.read

type: float

TODO


==== collectd.processes.ps_disk_octets.write

type: float

TODO


==== collectd.processes.fork_rate

type: float

collectd's fork_rate type of processes plugin.



'''
[[exported-fields-collectd.disk]]
=== [big]*collectd.disk Fields*

Corresponds to collectd's disk plugin.




'''
[[exported-fields-collectd.disk.disk_merged]]
=== [big]*collectd.disk.disk_merged Fields*

collectd's disk_merged type of disk plugin.



==== collectd.disk.disk_merged.read

type: float

TODO


==== collectd.disk.disk_merged.write

type: float

TODO



'''
[[exported-fields-collectd.disk.disk_octets]]
=== [big]*collectd.disk.disk_octets Fields*

collectd's disk_octets type of disk plugin.



==== collectd.disk.disk_octets.read

type: float

TODO


==== collectd.disk.disk_octets.write

type: float

TODO



'''
[[exported-fields-collectd.disk.disk_time]]
=== [big]*collectd.disk.disk_time Fields*

collectd's disk_time type of disk plugin.



==== collectd.disk.disk_time.read

type: float

TODO


==== collectd.disk.disk_time.write

type: float

TODO



'''
[[exported-fields-collectd.disk.disk_ops]]
=== [big]*collectd.disk.disk_ops Fields*

collectd's disk_ops type of disk plugin.



==== collectd.disk.disk_ops.read

type: float

TODO


==== collectd.disk.disk_ops.write

type: float

TODO


==== collectd.disk.pending_operations

type: long

collectd's pending_operations type of disk plugin.



'''
[[exported-fields-collectd.disk.disk_io_time]]
=== [big]*collectd.disk.disk_io_time Fields*

collectd's disk_io_time type of disk plugin.



==== collectd.disk.disk_io_time.io_time

type: float

TODO


==== collectd.disk.disk_io_time.weighted_io_time

type: float

TODO



'''
[[exported-fields-collectd.interface]]
=== [big]*collectd.interface Fields*

Corresponds to collectd's interface plugin.




'''
[[exported-fields-collectd.interface.if_octets]]
=== [big]*collectd.interface.if_octets Fields*

collectd's if_octets type of interface plugin.



==== collectd.interface.if_octets.rx

type: float

TODO


==== collectd.interface.if_octets.tx

type: float

TODO



'''
[[exported-fields-collectd.interface.if_packets]]
=== [big]*collectd.interface.if_packets Fields*

collectd's if_packets type of interface plugin.



==== collectd.interface.if_packets.rx

type: float

TODO


==== collectd.interface.if_packets.tx

type: float

TODO



'''
[[exported-fields-collectd.interface.if_errors]]
=== [big]*collectd.interface.if_errors Fields*

collectd's if_errors type of interface plugin.



==== collectd.interface.if_errors.rx

type: float

TODO


==== collectd.interface.if_errors.tx

type: float

TODO



'''
[[exported-fields-collectd.interface.if_dropped]]
=== [big]*collectd.interface.if_dropped Fields*

collectd's if_dropped type of interface plugin.



==== collectd.interface.if_dropped.rx

type: float

TODO


==== collectd.interface.if_dropped.tx

type: float

TODO



'''
[[exported-fields-collectd.virt]]
=== [big]*collectd.virt Fields*

Corresponds to collectd's virt plugin.




'''
[[exported-fields-collectd.virt.if_octets]]
=== [big]*collectd.virt.if_octets Fields*

collectd's if_octets type of virt plugin.



==== collectd.virt.if_octets.rx

type: float

TODO


==== collectd.virt.if_octets.tx

type: float

TODO



'''
[[exported-fields-collectd.virt.if_packets]]
=== [big]*collectd.virt.if_packets Fields*

collectd's if_packets type of virt plugin.



==== collectd.virt.if_packets.rx

type: float

TODO


==== collectd.virt.if_packets.tx

type: float

TODO



'''
[[exported-fields-collectd.virt.if_errors]]
=== [big]*collectd.virt.if_errors Fields*

collectd's if_errors type of virt plugin.



==== collectd.virt.if_errors.rx

type: float

TODO


==== collectd.virt.if_errors.tx

type: float

TODO



'''
[[exported-fields-collectd.virt.if_dropped]]
=== [big]*collectd.virt.if_dropped Fields*

collectd's if_dropped type of virt plugin.



==== collectd.virt.if_dropped.rx

type: float

TODO


==== collectd.virt.if_dropped.tx

type: float

TODO



'''
[[exported-fields-collectd.virt.disk_ops]]
=== [big]*collectd.virt.disk_ops Fields*

collectd's disk_ops type of virt plugin.



==== collectd.virt.disk_ops.read

type: float

TODO


==== collectd.virt.disk_ops.write

type: float

TODO



'''
[[exported-fields-collectd.virt.disk_octets]]
=== [big]*collectd.virt.disk_octets Fields*

collectd's disk_octets type of virt plugin.



==== collectd.virt.disk_octets.read

type: float

TODO


==== collectd.virt.disk_octets.write

type: float

TODO


==== collectd.virt.memory

type: float

collectd's memory type of virt plugin.


==== collectd.virt.virt_vcpu

type: float

collectd's virt_vcpu type of virt plugin.


==== collectd.virt.virt_cpu_total

type: float

collectd's virt_cpu_total type of virt plugin.



'''
[[exported-fields-collectd.cpu]]
=== [big]*collectd.cpu Fields*

Corresponds to collectd's CPU plugin.



==== collectd.cpu.percent

type: float

collectd's type percent of plugin CPU.



'''
[[exported-fields-collectd.df]]
=== [big]*collectd.df Fields*

Corresponds to collectd's df plugin.



==== collectd.df.df_complex

type: float

collectd's type df_complex of plugin df.


==== collectd.df.percent_bytes

type: float

collectd's type percent_bytes of plugin df.



'''
[[exported-fields-collectd.entropy]]
=== [big]*collectd.entropy Fields*

Corresponds to collectd's entropy plugin.



==== collectd.entropy.entropy

type: long

collectd's entropy type of entropy plugin.



'''
[[exported-fields-collectd.nfs]]
=== [big]*collectd.nfs Fields*

Corresponds to collectd's nfs plugin.



==== collectd.nfs.nfs_procedure

type: long

collectd's nfs_procedure type of nfs plugin.



'''
[[exported-fields-collectd.memory]]
=== [big]*collectd.memory Fields*

Corresponds to collectd's memory plugin.



==== collectd.memory.memory

type: float

collectd's memory type of memory plugin.


==== collectd.memory.percent

type: float

collectd's percent type of memory plugin.



'''
[[exported-fields-collectd.swap]]
=== [big]*collectd.swap Fields*

Corresponds to collectd's swap plugin.



==== collectd.swap.swap

type: long

collectd's swap type of swap plugin.


==== collectd.swap.swap_io

type: long

collectd's swap_io type of swap plugin.



'''
[[exported-fields-collectd.load]]
=== [big]*collectd.load Fields*

Corresponds to collectd's load plugin.




'''
[[exported-fields-collectd.load.load]]
=== [big]*collectd.load.load Fields*

collectd's load type of load plugin



==== collectd.load.load.shortterm

type: float

TODO


==== collectd.load.load.midterm

type: float

TODO


==== collectd.load.load.longterm

type: float

TODO



'''
[[exported-fields-collectd.aggregation]]
=== [big]*collectd.aggregation Fields*

Corresponds to collectd's aggregation plugin.



==== collectd.aggregation.percent

type: float

TODO



'''
[[exported-fields-collectd.statsd]]
=== [big]*collectd.statsd Fields*

Corresponds to collectd's statsd plugin.



==== collectd.statsd.host_cpu

type: long

collectd's cpu type of statsd plugin.


==== collectd.statsd.host_elapsed_time

type: long

collectd's elapsed_time type of statsd plugin.


==== collectd.statsd.host_memory

type: long

collectd's memory type of statsd plugin.


==== collectd.statsd.host_nic_speed

type: long

collectd's nic_speed type of statsd plugin.


==== collectd.statsd.host_nic_rx

type: long

collectd's nic_rx type of statsd plugin.


==== collectd.statsd.host_nic_tx

type: long

collectd's nic_tx type of statsd plugin.


==== collectd.statsd.host_nic_rx_dropped

type: long

collectd's nic_rx_dropped type of statsd plugin.


==== collectd.statsd.host_nic_tx_dropped

type: long

collectd's nic_tx_dropped type of statsd plugin.


==== collectd.statsd.host_nic_rx_errors

type: long

collectd's nic_rx_errors type of statsd plugin.


==== collectd.statsd.host_nic_tx_errors

type: long

collectd's nic_tx_errors type of statsd plugin.


==== collectd.statsd.host_storage

type: long

collectd's storage type of statsd plugin.


==== collectd.statsd.host_swap

type: long

collectd's swap type of statsd plugin.


==== collectd.statsd.host_vdsm

type: long

collectd's vdsm type of statsd plugin.


==== collectd.statsd.host_vms

type: long

collectd's vms type of statsd plugin.


==== collectd.statsd.vm_nic_tx_dropped

type: long

collectd's nic_tx_dropped type of statsd plugin.


==== collectd.statsd.vm_nic_rx_bytes

type: long

collectd's nic_rx_bytes type of statsd plugin.


==== collectd.statsd.vm_nic_tx_bytes

type: long

collectd's nic_tx_bytes type of statsd plugin.


==== collectd.statsd.vm_balloon_min

type: long

collectd's balloon_min type of statsd plugin.


==== collectd.statsd.vm_balloon_max

type: long

collectd's balloon_max type of statsd plugin.


==== collectd.statsd.vm_balloon_target

type: long

collectd's balloon_target type of statsd plugin.


==== collectd.statsd.vm_balloon_cur

type: long

collectd's balloon_cur type of statsd plugin.


==== collectd.statsd.vm_memory_majflt

type: long

collectd's vm_memory_majflt type of statsd plugin.


==== collectd.statsd.vm_memory_mem_free

type: long

collectd's vm_memory_mem_free type of statsd plugin.


==== collectd.statsd.vm_memory_mem_total

type: long

collectd's vm_memory_mem_total type of statsd plugin.


==== collectd.statsd.vm_memory_mem_unused

type: long

collectd's vm_memory_mem_unused type of statsd plugin.


==== collectd.statsd.vm_memory_mem_used

type: long

collectd's vm_memory_mem_used type of statsd plugin.


==== collectd.statsd.vm_memory_pageflt

type: long

collectd's vm_memory_pageflt type of statsd plugin.


==== collectd.statsd.vm_memory_swap_in

type: long

collectd's vm_memory_swap_in type of statsd plugin.


==== collectd.statsd.vm_memory_swap_out

type: long

collectd's vm_memory_swap_out type of statsd plugin.


==== collectd.statsd.vm_cpu_sys

type: long

collectd's cpu_sys type of statsd plugin.


==== collectd.statsd.vm_cpu_usage

type: long

collectd's cpu_usage type of statsd plugin.


==== collectd.statsd.vm_disk_read_ops

type: long

collectd's disk_read_ops type of statsd plugin.


==== collectd.statsd.vm_disk_write_ops

type: long

collectd's disk_write_ops type of statsd plugin.


==== collectd.statsd.vm_disk_flush_latency

type: long

collectd's disk_flush_latency type of statsd plugin.


==== collectd.statsd.vm_disk_apparent_size

type: long

collectd's disk_apparent_size type of statsd plugin.


==== collectd.statsd.vm_disk_write_bytes

type: long

collectd's disk_write_bytes type of statsd plugin.


==== collectd.statsd.vm_disk_write_rate

type: long

collectd's disk_write_rate type of statsd plugin.


==== collectd.statsd.vm_disk_true_size

type: long

collectd's disk_true_size type of statsd plugin.


==== collectd.statsd.vm_disk_read_rate

type: long

collectd's disk_read_rate type of statsd plugin.


==== collectd.statsd.vm_disk_write_latency

type: long

collectd's disk_write_latency type of statsd plugin.


==== collectd.statsd.vm_disk_read_latency

type: long

collectd's disk_read_latency type of statsd plugin.


==== collectd.statsd.vm_disk_read_bytes

type: long

collectd's disk_read_bytes type of statsd plugin.


==== collectd.statsd.vm_nic_rx_dropped

type: long

collectd's nic_rx_dropped type of statsd plugin.


==== collectd.statsd.vm_cpu_user

type: long

collectd's cpu_user type of statsd plugin.


==== collectd.statsd.vm_nic_rx_errors

type: long

collectd's nic_rx_errors type of statsd plugin.


==== collectd.statsd.vm_nic_tx_errors

type: long

collectd's nic_tx_errors type of statsd plugin.


==== collectd.statsd.vm_nic_speed

type: long

collectd's nic_speed type of statsd plugin.



'''
[[exported-fields-collectd.postgresql]]
=== [big]*collectd.postgresql Fields*

Corresponds to collectd's postgresql plugin.



==== collectd.postgresql.pg_n_tup_g

type: long

collectd's type pg_n_tup_g of plugin postgresql.


==== collectd.postgresql.pg_n_tup_c

type: long

collectd's type pg_n_tup_c of plugin postgresql.


==== collectd.postgresql.pg_numbackends

type: long

collectd's type pg_numbackends of plugin postgresql.


==== collectd.postgresql.pg_xact

type: long

collectd's type pg_xact of plugin postgresql.


==== collectd.postgresql.pg_db_size

type: long

collectd's type pg_db_size of plugin postgresql.


==== collectd.postgresql.pg_blks

type: long

collectd's type pg_blks of plugin postgresql.



'''
[[exported-fields-pipeline_metadata]]
=== [big]*pipeline_metadata Fields*

Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here. Data in this subgroup is stored for troublehsooting purposes mostly.



==== pipeline_metadata.@version

type: keyword

example: TODO

Version of “com.redhat.viaq” mapping the document is intended to adhere by the normalizer. It must be set by the normalizer. The value must correspond to the [_meta][version].



'''
[[exported-fields-pipeline_metadata.collector]]
=== [big]*pipeline_metadata.collector Fields*

The section contains metadata specific to the collector.



==== pipeline_metadata.collector.hostname

type: keyword

FQDN of the collector. It might be different from the FQDN of the actual emitter of the logs.


==== pipeline_metadata.collector.name

type: keyword

Name of the collector.


==== pipeline_metadata.collector.version

type: keyword

Version of the collector


==== pipeline_metadata.collector.ipaddr4

type: ip

IP address v4 of the collector server, can be an array.


==== pipeline_metadata.collector.ipaddr6

type: ip

IP address v6 of the collector server, can be an array.


==== pipeline_metadata.collector.inputname

type: keyword

how the log message was received on the collector whether it was TCP/UDP, or maybe imjournal/imfile.


==== pipeline_metadata.collector.received_at

type: date

format: yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ||yyyy-MM-dd'T'HH:mm:ssZ||dateOptionalTime

Time when the message was received at the collector.


==== pipeline_metadata.collector.original_raw_message

type: text

The original non-parsed log message, collected by collector or as close to the source as possible.



'''
[[exported-fields-pipeline_metadata.normalizer]]
=== [big]*pipeline_metadata.normalizer Fields*

The section contains metadata specific to the normalizer.



==== pipeline_metadata.normalizer.hostname

type: keyword

FQDN of the normalizer.


==== pipeline_metadata.normalizer.name

type: keyword

Name of the normalizer.


==== pipeline_metadata.normalizer.version

type: keyword

Version of the normalizer


==== pipeline_metadata.normalizer.ipaddr4

type: ip

IP address v4 of the normalizer server, can be an array.


==== pipeline_metadata.normalizer.ipaddr6

type: ip

IP address v6 of the normalizer server, can be an array.


==== pipeline_metadata.normalizer.inputname

type: keyword

how the log message was received on the normalizer whether it was TCP/UDP.


==== pipeline_metadata.normalizer.received_at

type: date

format: yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ||yyyy-MM-dd'T'HH:mm:ssZ||dateOptionalTime

Time when the message was received at the collector.


==== pipeline_metadata.normalizer.original_raw_message

type: text

The original non-parsed log message as it is received at the normalizer.


==== pipeline_metadata.trace

type: text

example: rsyslog,8.16,2016.02.01 logstash,1.5,2016.03.03

The field records the trace of the message. Each collector/normalizer appends information about itself and the date/time when the message was processed.



'''
[[exported-fields-kubernetes]]
=== [big]*kubernetes Fields*

Namespace for kubernetes-specific metadata



==== kubernetes.pod_name

type: keyword

The name of the pod


==== kubernetes.pod_id

type: keyword

Kubernetes ID of the pod.


==== kubernetes.namespace_name

type: keyword

The name of the namespace in Kubernetes.


==== kubernetes.namespace_id

type: keyword

ID of the namespace in Kubernetes.


==== kubernetes.host

type: keyword

Kubernetes node name


==== kubernetes.master_url

type: keyword

Kubernetes Master URL


==== kubernetes.container_name

type: text

The name of the container in Kubernetes.



'''
[[exported-fields-kubernetes.annotations]]
=== [big]*kubernetes.annotations Fields*

Annotations associated with the OpenShift object



'''
[[exported-fields-kubernetes.labels]]
=== [big]*kubernetes.labels Fields*

Labels attached to the OpenShift object Each label name is a subfield of labels field. Each label name is de-dotted: dots in the name are replaced with underscores.



==== kubernetes.labels.deployment

type: keyword

example: logging-kibana-3

The deployment associated with this Kubernetes object


==== kubernetes.labels.deploymentconfig

type: keyword

example: logging-kibana

The deploymentconfig associated with this Kubernetes object


==== kubernetes.labels.component

type: keyword

example: kibana

The component associated with this Kubernetes object


==== kubernetes.labels.provider

type: keyword

example: openshift

The provider associated with this Kubernetes object



'''
[[exported-fields-kubernetes.event]]
=== [big]*kubernetes.event Fields*

The kubernetes event obtained from kubernetes master API The event is already JSON object and as whole nested under kubernetes field This description should loosely follow 'type Event' in https://github.com/kubernetes/kubernetes/blob/master/pkg/api/types.go



==== kubernetes.event.verb

type: keyword

example: ADDED

The type of event, can be ADDED, MODIFIED, DELETED



'''
[[exported-fields-kubernetes.event.metadata]]
=== [big]*kubernetes.event.metadata Fields*

Information related to the location and time of the event creation



==== kubernetes.event.metadata.name

type: keyword

example: java-mainclass-1.14d888a4cfc24890

Name of the object that triggered the event creation


==== kubernetes.event.metadata.namespace

type: keyword

example: default

The name of the namespace which induced the event It differs from namespace_name, which will be in case of every event the 'eventrouter'


==== kubernetes.event.metadata.selfLink

type: keyword

example: /api/v1/namespaces/javaj/events/java-mainclass-1.14d888a4cfc24890

Link to the event itself


==== kubernetes.event.metadata.uid

type: keyword

example: d828ac69-7b58-11e7-9cf5-5254002f560c

Event's unique ID


==== kubernetes.event.metadata.resourceVersion

type: keyword

example: 311987

String that identifies the server's internal version of the event that can be used by clients to determine when objects have changed



'''
[[exported-fields-kubernetes.event.involvedObject]]
=== [big]*kubernetes.event.involvedObject Fields*

Description of the object involved in the event creation



==== kubernetes.event.involvedObject.kind

type: keyword

example: ReplicationController

Type of the object


==== kubernetes.event.involvedObject.namespace

type: keyword

example: default

The name of the namespace in which the object triggered the event In case this event is not triggered by a pod then it differs from kubernetes.namespace_name, which will be in case of every event eventrouter's namespace


==== kubernetes.event.involvedObject.name

type: keyword

example: java-mainclass-1

Name of the object that triggered the event


==== kubernetes.event.involvedObject.uid

type: keyword

example: e6bff941-76a8-11e7-8193-5254002f560c

Object's unique ID


==== kubernetes.event.involvedObject.apiVersion

type: keyword

example: v1

Version of kubernetes master API


==== kubernetes.event.involvedObject.resourceVersion

type: keyword

example: 308882

String that identifies the server's internal version of the pod triggering the event that can be used by clients to determine when objects have changed


==== kubernetes.event.reason

type: keyword

example: SuccessfulCreate

Short, machine understandable string that gives the reason for this event being generated


==== kubernetes.event.source_component

type: keyword

example: replication-controller

Component which reported this event


==== kubernetes.event.firstTimestamp

type: date

example: 2017-08-07 10:11:57+00:00

format: yyyy-MM-dd HH:mm:ss,SSSZ||yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ||yyyy-MM-dd'T'HH:mm:ssZ||dateOptionalTime

The time at which the event was first recorded


==== kubernetes.event.count

type: integer

example: 1

The number of times this event has occurred


==== kubernetes.event.type

type: keyword

example: Normal

Type of this event (Normal, Warning), new types could be added in the future
