[system] - Cleanup fields.yml files

packages/system/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.41.0"
+  changes:
+    - description: Modified the field definitions to reference ECS where possible and remove invalid field attributes.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/8100
 - version: "1.40.0"
   changes:
     - description: Add metric_type metadata for object fields, set stack restriction to 8.9.0 version

packages/system/data_stream/application/fields/agent.yml

@@ -1,184 +1,65 @@
 - name: cloud
-  title: Cloud
-  group: 2
-  description: Fields related to the cloud or infrastructure the events are coming from.
-  footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.'
   type: group
   fields:
     - name: account.id
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment.
-
-        Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.'
-      example: 666777888999
+      external: ecs
     - name: availability_zone
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: Availability zone in which this host is running.
-      example: us-east-1c
+      external: ecs
     - name: instance.id
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: Instance ID of the host machine.
-      example: i-1234567890abcdef0
+      external: ecs
     - name: instance.name
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: Instance name of the host machine.
+      external: ecs
     - name: machine.type
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: Machine type of the host machine.
-      example: t2.medium
+      external: ecs
     - name: provider
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.
-      example: aws
+      external: ecs
     - name: region
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: Region in which this host is running.
-      example: us-east-1
+      external: ecs
     - name: project.id
-      type: keyword
-      description: Name of the project in Google Cloud.
+      external: ecs
     - name: image.id
       type: keyword
       description: Image ID for the cloud instance.
 - name: container
-  title: Container
-  group: 2
-  description: 'Container fields are used for meta information about the specific container that is the source of information.
-
-    These fields help correlate data based containers from any runtime.'
   type: group
   fields:
     - name: id
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: Unique container id.
+      external: ecs
     - name: image.name
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: Name of the image the container was built on.
+      external: ecs
     - name: labels
-      level: extended
-      type: object
-      object_type: keyword
-      description: Image labels.
+      external: ecs
     - name: name
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: Container name.
+      external: ecs
 - name: host
-  title: Host
-  group: 2
-  description: 'A host is defined as a general computing instance.
-
-    ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.'
   type: group
   fields:
     - name: architecture
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: Operating system architecture.
-      example: x86_64
+      external: ecs
     - name: domain
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: 'Name of the domain of which the host is a member.
-
-        For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.'
-      example: CONTOSO
-      default_field: false
+      external: ecs
     - name: hostname
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: 'Hostname of the host.
-
-        It normally contains what the `hostname` command returns on the host machine.'
+      external: ecs
     - name: id
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: 'Unique host id.
-
-        As hostname is not always unique, use values that are meaningful in your environment.
-
-        Example: The current usage of `beat.name`.'
+      external: ecs
     - name: ip
-      level: core
-      type: ip
-      description: Host ip addresses.
+      external: ecs
     - name: mac
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: Host mac addresses.
+      external: ecs
     - name: name
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: 'Name of the host.
-
-        It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.'
+      external: ecs
     - name: os.family
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: OS family (such as redhat, debian, freebsd, windows).
-      example: debian
+      external: ecs
     - name: os.kernel
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: Operating system kernel version as a raw string.
-      example: 4.4.0-112-generic
+      external: ecs
     - name: os.name
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      multi_fields:
-        - name: text
-          type: text
-          norms: false
-          default_field: false
-      description: Operating system name, without the version.
-      example: Mac OS X
+      external: ecs
     - name: os.platform
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: Operating system platform (such centos, ubuntu, windows).
-      example: darwin
+      external: ecs
     - name: os.version
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: Operating system version as a raw string.
-      example: 10.14.1
+      external: ecs
     - name: type
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: 'Type of host.
-
-        For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.'
+      external: ecs
     - name: containerized
       type: boolean
       description: >

packages/system/data_stream/application/fields/base-fields.yml

@@ -1,20 +1,16 @@
 - name: data_stream.type
-  type: constant_keyword
-  description: Data stream type.
+  external: ecs
 - name: data_stream.dataset
-  type: constant_keyword
-  description: Data stream dataset.
+  external: ecs
 - name: data_stream.namespace
-  type: constant_keyword
-  description: Data stream namespace.
-- name: '@timestamp'
-  type: date
-  description: Event timestamp.
+  external: ecs
+- name: "@timestamp"
+  external: ecs
 - name: event.module
   type: constant_keyword
-  description: Event module
+  external: ecs
   value: system
 - name: event.dataset
   type: constant_keyword
-  description: Event dataset.
+  external: ecs
   value: system.application

packages/system/data_stream/application/fields/winlog.yml

@@ -1,31 +1,24 @@
 - name: winlog
   type: group
-  description: >
-    All fields specific to the Windows Event Log are defined here.
-
   fields:
     - name: api
-      required: true
       type: keyword
       description: >
         The event log API type used to read the record. The possible values are "wineventlog" for the Windows Event Log API or "eventlogging" for the Event Logging API. The Event Logging API was designed for Windows Server 2003 or Windows 2000 operating systems. In Windows Vista, the event logging infrastructure was redesigned. On Windows Vista or later operating systems, the Windows Event Log API is used. Winlogbeat automatically detects which API to use for reading event logs.
 
     - name: activity_id
       type: keyword
-      required: false
       description: >
         A globally unique identifier that identifies the current activity. The events that are published with this identifier are part of the same activity.
 
     - name: computer_name
       type: keyword
-      required: true
       description: >
         The name of the computer that generated the record. When using Windows event forwarding, this name can differ from `agent.hostname`.
 
     - name: event_data
       type: object
       object_type: keyword
-      required: false
       description: >
         The event-specific data. This field is mutually exclusive with `user_data`. If you are capturing event data on versions prior to Windows Vista, the parameters in `event_data` are named `param1`, `param2`, and so on, because event log parameters are unnamed in earlier versions of Windows.
 
@@ -259,77 +252,64 @@
           type: keyword
     - name: event_id
       type: keyword
-      required: true
       description: >
         The event identifier. The value is specific to the source of the event.
 
     - name: keywords
       type: keyword
-      required: false
       description: >
         The keywords are used to classify an event.
 
     - name: channel
       type: keyword
-      required: true
       description: >
         The name of the channel from which this record was read. This value is one of the names from the `event_logs` collection in the configuration.
 
     - name: record_id
       type: keyword
-      required: true
       description: >
         The record ID of the event log record. The first record written to an event log is record number 1, and other records are numbered sequentially. If the record number reaches the maximum value (2^32^ for the Event Logging API and 2^64^ for the Windows Event Log API), the next record number will be 0.
 
     - name: related_activity_id
       type: keyword
-      required: false
       description: >
         A globally unique identifier that identifies the activity to which control was transferred to. The related events would then have this identifier as their `activity_id` identifier.
 
     - name: opcode
       type: keyword
-      required: false
       description: >
         The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.
 
     - name: provider_guid
       type: keyword
-      required: false
       description: >
         A globally unique identifier that identifies the provider that logged the event.
 
     - name: process.pid
       type: long
-      required: false
       description: >
         The process_id of the Client Server Runtime Process.
 
     - name: provider_name
       type: keyword
-      required: true
       description: >
         The source of the event log record (the application or service that logged the record).
 
     - name: task
       type: keyword
-      required: false
       description: >
         The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. The category used by the Event Logging API (on pre Windows Vista operating systems) is written to this field.
 
     - name: process.thread.id
       type: long
-      required: false
     - name: user_data
       type: object
       object_type: keyword
-      required: false
       description: >
         The event specific data. This field is mutually exclusive with `event_data`.
 
     - name: user.identifier
       type: keyword
-      required: false
       example: S-1-5-21-3541430928-2051711210-1391384369-1001
       description: >
         The Windows security identifier (SID) of the account associated with this event. If Winlogbeat cannot resolve the SID to a name, then the `user.name`, `user.domain`, and `user.type` fields will be omitted from the event. If you discover Winlogbeat not resolving SIDs, review the log for clues as to what the problem may be.
@@ -341,17 +321,14 @@
 
     - name: user.domain
       type: keyword
-      required: false
       description: >
         The domain that the account associated with this event is a member of.
 
     - name: user.type
       type: keyword
-      required: false
       description: >
         The type of account associated with this event.
 
     - name: version
       type: long
-      required: false
       description: The version number of the event's definition.