
////
This file is generated! See scripts/generate_template.py --docs
////

[[exported-fields]]
== Exported Fields

These are the fields exported by the logging system and available for searching
from Elasticsearch and Kibana.  Use the full, dotted field name when searching.
For example, for an Elasticsearch /_search URL, to look for a Kubernetes pod name,
use `/_search/q=kubernetes.pod_name:name-of-my-pod`
This document describes fields that may not be present in your logging store.
Not all of these fields are present in every record.
The fields are grouped in the following categories:

* <<exported-fields-Default>>
* <<exported-fields-rsyslog>>
* <<exported-fields-systemd>>
* <<exported-fields-kubernetes>>
* <<exported-fields-docker>>
* <<exported-fields-pipeline_metadata>>
* <<exported-fields-ovirt>>
* <<exported-fields-aushape>>
* <<exported-fields-tlog>>


'''
[[exported-fields-Default]]
=== [big]*Top Level Fields*

The top level fields are common to every application, and may be present in every record.
For the Elasticsearch template, this is what populates the actual mappings
of _default_ in the template's mapping section.



==== @timestamp

type: date

example: 2015-01-24 14:06:05.071000

format: yyyy-MM-dd HH:mm:ss,SSSZ||yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ||yyyy-MM-dd'T'HH:mm:ssZ||dateOptionalTime

UTC value marking when the log payload was created, or when log payload was first collected if the creation time is not known;
this is the log processing pipeline’s “best effort” determination of when the log payload was generated
FYI: the “@” prefix convention to note a field as being reserved for a particular use; in this case, most tools by default look for “@timestamp” with ElasticSearch


==== geoip

type: object

geo-ip of the machine


==== hostname

type: keyword

FQDN of the entity generating the original payload.  This field is a best effort attempt to derive this context; sometimes the entity generating it knows it; other times that entity has a restricted namespace itself, and the collector or normalizer knows that.


==== ipaddr4

type: ip

IP address v4 of the source server. Can be an array.


==== ipaddr6

type: ip

IP address v6 of the source server (if available). Can be an array.


==== level

type: keyword

example: info

Logging level as provided by: rsyslog(severitytext property), python's
logging module, etc.
Possible values are as listed here: http://sourceware.org/git/?p=glibc.git;a=blob;f=misc/sys/syslog.h;h=ee01478c4b19a954426a96448577c5a76e6647c0;hb=HEAD#l74 plus `trace` and `unknown`
That is: alert crit debug emerg err info notice trace unknown warning
Note that `trace` isn't in the syslog.h list but many applications use it
`unknown` is only used when the logging system gets a value it doesn't understand
`unknown` is the highest level
`trace` should be considered as higher (more verbose) than `debug`
`error` should be converted to `err`
`panic` should be converted to `emerg`
`warn` should be converted to `warning`
Numeric values from syslog/journal PRIORITY can usually be mapped using the priority values as listed here:
http://sourceware.org/git/?p=glibc.git;a=blob;f=misc/sys/syslog.h;h=ee01478c4b19a954426a96448577c5a76e6647c0;hb=HEAD#l51
That is, 0 -> emerg, 1 -> alert, ..., 7 -> debug, 8 -> trace, 9 -> unknown
Log levels/priorities from other logging systems should be mapped to the nearest match
For example, from python logging: https://docs.python.org/2.7/library/logging.html#logging-levels
CRITICAL -> crit, ERROR -> err, ...., DEBUG -> debug


==== message

type: text

example: TODO

Typical log entry message, or payload, possibly stripped of metadata pulled out of it by collector/normalizer, UTF-8 encoded.


==== pid

type: keyword

This is the process ID of the logging entity, if available.


==== service

type: keyword

Name of the service associated with the logging entity, if available. For example, syslog's APP-NAME and rsyslog's programname property are mapped to the service field.


==== tags

type: text

Optionally provided operator defined list of tags placed on each log by the collector or normalizer. The payload can be a string with whitespace-delimited string tokens, or a JSON list of string tokens.


==== file

type: text

Optional path to the file containing the log entry local to the collector TODO: analyzer for file paths


==== offset

type: long

The offset value can represent bytes to the start of the log line in the file (zero or one based), or log line numbers (zero or one based), so long as the values are strictly monotonically increasing in the context of a single log file. They values are allowed to wrap, representing a new version of the log file (rotation).


==== namespace_name

type: keyword

example: my-cool-project-in-lab04

format: [a-zA-Z][a-zA-Z0-9-]{0,61}[a-zA-Z0-9]

Associate this record with the namespace with this name.
This value will not be stored.  It is only used to associate the
record with the appropriate namespace for access control and
visualization.  Normally this value will be given in the tag, but if the
protocol does not support sending a tag, this field can be used.
If this field is present, it will override the
namespace given in the tag or in kubernetes.namespace_name.
The format is the same format used for Kubernetes namespace names.
See also namespace_uuid.


==== namespace_uuid

type: keyword

example: 82f13a8e-882a-4344-b103-f0a6f30fd218

format: [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}

The uuid associated with the namespace_name.
This value will not be stored.  It is only used to associate the
record with the appropriate namespace for access control and
visualization.  If this field is present, it will override the
uuid given in kubernetes.namespace_uuid.  This will also cause
the Kubernetes metadata lookup to be skipped for this log record.


==== viaq_msg_id

type: keyword

example: 82f13a8e-882a-4344-b103-f0a6f30fd218

A unique ID assigned to each message.  The format is not specified.
It may be a UUID or a Base64 or some other ascii value.
This is currently generated by
https://github.com/uken/fluent-plugin-elasticsearch/tree/v1.13.2#generate-hash-id
and is used as the `_id` of the document in Elasticsearch.
An intended use of this field is that if you use another logging
store or application other than Elasticsearch, but you still need
to correlate data with the data stored in Elasticsearch, this field
will give you the exact document corresponding to the record.



'''
[[exported-fields-rsyslog]]
=== [big]*rsyslog Fields*

RFC5424 based metadata.



==== rsyslog.facility

type: keyword

rsyslog's facility. see syslog specification for more information


==== rsyslog.protocol-version

type: keyword

rsyslog protocol version


==== rsyslog.structured-data

type: keyword

syslog's structured-data. see syslog specification for more information


==== rsyslog.msgid

type: long

syslog's msgid field


==== rsyslog.appname

type: keyword

syslog's APP-NAME. If APP-NAME is same as programname, we only fill top-level field 'service'. If APP-NAME is not equal to programname, this field will hold APP-NAME. See syslog specification for more information



'''
[[exported-fields-systemd]]
=== [big]*systemd Fields*

Contains common fields specific to systemd journal.  For more information please see https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html Applications may write their own fields to the journal.  These will be available under the `systemd.u` namespace.  `RESULT` and `UNIT` are two such fields.




'''
[[exported-fields-systemd.k]]
=== [big]*systemd.k Fields*

systemd's kernel-specific metadata.



==== systemd.k.KERNEL_DEVICE

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_KERNEL_DEVICE=


==== systemd.k.KERNEL_SUBSYSTEM

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_KERNEL_SUBSYSTEM=


==== systemd.k.UDEV_DEVLINK

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_UDEV_DEVLINK=


==== systemd.k.UDEV_DEVNODE

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_UDEV_DEVNODE=


==== systemd.k.UDEV_SYSNAME

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_UDEV_SYSNAME=



'''
[[exported-fields-systemd.t]]
=== [big]*systemd.t Fields*

trusted journal fields, fields that are implicitly added by the journal and cannot be altered by client code.



==== systemd.t.AUDIT_LOGINUID

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_AUDIT_SESSION=


==== systemd.t.BOOT_ID

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_BOOT_ID=


==== systemd.t.AUDIT_SESSION

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_AUDIT_SESSION=


==== systemd.t.CAP_EFFECTIVE

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_CAP_EFFECTIVE=


==== systemd.t.CMDLINE

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_COMM=


==== systemd.t.COMM

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_COMM=


==== systemd.t.EXE

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_COMM=


==== systemd.t.GID

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_PID=


==== systemd.t.HOSTNAME

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_HOSTNAME=


==== systemd.t.MACHINE_ID

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_MACHINE_ID=


==== systemd.t.PID

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_PID=


==== systemd.t.SELINUX_CONTEXT

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_SELINUX_CONTEXT=


==== systemd.t.SOURCE_REALTIME_TIMESTAMP

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_SOURCE_REALTIME_TIMESTAMP=
This is converted to RFC 3339 NS format


==== systemd.t.SYSTEMD_CGROUP

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_SYSTEMD_CGROUP=


==== systemd.t.SYSTEMD_OWNER_UID

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_SYSTEMD_CGROUP=


==== systemd.t.SYSTEMD_SESSION

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_SYSTEMD_CGROUP=


==== systemd.t.SYSTEMD_SLICE

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_SYSTEMD_CGROUP=


==== systemd.t.SYSTEMD_UNIT

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_SYSTEMD_CGROUP=


==== systemd.t.SYSTEMD_USER_UNIT

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_SYSTEMD_CGROUP=


==== systemd.t.TRANSPORT

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_TRANSPORT=


==== systemd.t.UID

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#_PID=



'''
[[exported-fields-systemd.u]]
=== [big]*systemd.u Fields*

fields that are directly passed from clients and stored in the journal.



==== systemd.u.CODE_FILE

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#CODE_FILE=


==== systemd.u.CODE_FUNCTION

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#CODE_FILE=


==== systemd.u.CODE_LINE

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#CODE_FILE=


==== systemd.u.ERRNO

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#ERRNO=


==== systemd.u.MESSAGE_ID

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#MESSAGE_ID=


==== systemd.u.SYSLOG_FACILITY

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#SYSLOG_FACILITY=


==== systemd.u.SYSLOG_IDENTIFIER

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#SYSLOG_FACILITY=


==== systemd.u.SYSLOG_PID

type: keyword

https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#SYSLOG_FACILITY=


==== systemd.u.RESULT

type: keyword

For private use only.


==== systemd.u.UNIT

type: keyword

For private use only.



'''
[[exported-fields-kubernetes]]
=== [big]*kubernetes Fields*

Namespace for kubernetes-specific metadata



==== kubernetes.pod_name

type: keyword

The name of the pod


==== kubernetes.pod_id

type: keyword

Kubernetes ID of the pod.


==== kubernetes.namespace_name

type: keyword

The name of the namespace in Kubernetes.


==== kubernetes.namespace_id

type: keyword

ID of the namespace in Kubernetes.


==== kubernetes.host

type: keyword

Kubernetes node name


==== kubernetes.master_url

type: keyword

Kubernetes Master URL


==== kubernetes.container_name

type: text

The name of the container in Kubernetes.



'''
[[exported-fields-kubernetes.annotations]]
=== [big]*kubernetes.annotations Fields*

Annotations associated with the OpenShift object



'''
[[exported-fields-kubernetes.labels]]
=== [big]*kubernetes.labels Fields*

Labels attached to the OpenShift object Each label name is a subfield of labels field. Each label name is de-dotted: dots in the name are replaced with underscores.



==== kubernetes.labels.deployment

type: keyword

example: logging-kibana-3

The deployment associated with this Kubernetes object


==== kubernetes.labels.deploymentconfig

type: keyword

example: logging-kibana

The deploymentconfig associated with this Kubernetes object


==== kubernetes.labels.component

type: keyword

example: kibana

The component associated with this Kubernetes object


==== kubernetes.labels.provider

type: keyword

example: openshift

The provider associated with this Kubernetes object



'''
[[exported-fields-kubernetes.event]]
=== [big]*kubernetes.event Fields*

The kubernetes event obtained from kubernetes master API The event is already JSON object and as whole nested under kubernetes field This description should loosely follow 'type Event' in https://github.com/kubernetes/kubernetes/blob/master/pkg/api/types.go



==== kubernetes.event.verb

type: keyword

example: ADDED

The type of event, can be ADDED, MODIFIED, DELETED



'''
[[exported-fields-kubernetes.event.metadata]]
=== [big]*kubernetes.event.metadata Fields*

Information related to the location and time of the event creation



==== kubernetes.event.metadata.name

type: keyword

example: java-mainclass-1.14d888a4cfc24890

Name of the object that triggered the event creation


==== kubernetes.event.metadata.namespace

type: keyword

example: default

The name of the namespace which induced the event It differs from namespace_name, which will be in case of every event the 'eventrouter'


==== kubernetes.event.metadata.selfLink

type: keyword

example: /api/v1/namespaces/javaj/events/java-mainclass-1.14d888a4cfc24890

Link to the event itself


==== kubernetes.event.metadata.uid

type: keyword

example: d828ac69-7b58-11e7-9cf5-5254002f560c

Event's unique ID


==== kubernetes.event.metadata.resourceVersion

type: integer

example: 311987

String that identifies the server's internal version of the event that can be used by clients to determine when objects have changed



'''
[[exported-fields-kubernetes.event.involvedObject]]
=== [big]*kubernetes.event.involvedObject Fields*

Description of the object involved in the event creation



==== kubernetes.event.involvedObject.kind

type: keyword

example: ReplicationController

Type of the object


==== kubernetes.event.involvedObject.namespace

type: keyword

example: default

The name of the namespace in which the object triggered the event In case this event is not triggered by a pod then it differs from kubernetes.namespace_name, which will be in case of every event eventrouter's namespace


==== kubernetes.event.involvedObject.name

type: keyword

example: java-mainclass-1

Name of the object that triggered the event


==== kubernetes.event.involvedObject.uid

type: keyword

example: e6bff941-76a8-11e7-8193-5254002f560c

Object's unique ID


==== kubernetes.event.involvedObject.apiVersion

type: keyword

example: v1

Version of kubernetes master API


==== kubernetes.event.involvedObject.resourceVersion

type: keyword

example: 308882

String that identifies the server's internal version of the pod triggering the event that can be used by clients to determine when objects have changed


==== kubernetes.event.reason

type: keyword

example: SuccessfulCreate

Short, machine understandable string that gives the reason for this event being generated 


==== kubernetes.event.source_component

type: keyword

example: replication-controller

Component which reported this event


==== kubernetes.event.firstTimestamp

type: date

example: 2017-08-07 10:11:57

format: yyyy-MM-dd HH:mm:ss,SSSZ||yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ||yyyy-MM-dd'T'HH:mm:ssZ||dateOptionalTime

The time at which the event was first recorded


==== kubernetes.event.count

type: integer

example: 1

The number of times this event has occurred


==== kubernetes.event.type

type: keyword

example: Normal

Type of this event (Normal, Warning), new types could be added in the future



'''
[[exported-fields-docker]]
=== [big]*docker Fields*

Namespace for docker container-specific metadata



==== docker.container_name

type: text

The name of the container - not used for Kubernetes containers.


==== docker.container_id

type: keyword

Docker container id


==== docker.container_id_short

type: keyword

Short container id, assigned by the container engine


==== docker.sauid

type: keyword

Sent login user id


==== docker.container_image

type: keyword

Name of the image


==== docker.pid

type: keyword

The process id


==== docker.user

type: keyword

User under which the container process runs


==== docker.command

type: keyword

Name of the command


==== docker.reason

type: keyword

Action that triggered this event


==== docker.operation

type: keyword

Operation carried out


==== docker.result

type: keyword

Result of the action



'''
[[exported-fields-pipeline_metadata]]
=== [big]*pipeline_metadata Fields*

Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here. Data in this subgroup is stored for troublehsooting purposes mostly.



==== pipeline_metadata.@version

type: keyword

example: TODO

Version of “com.redhat.viaq” mapping the document is intended to adhere by the normalizer. It must be set by the normalizer. The value must correspond to the [_meta][version].



'''
[[exported-fields-pipeline_metadata.collector]]
=== [big]*pipeline_metadata.collector Fields*

The section contains metadata specific to the collector.



==== pipeline_metadata.collector.hostname

type: keyword

FQDN of the collector. It might be different from the FQDN of the actual emitter of the logs.


==== pipeline_metadata.collector.name

type: keyword

Name of the collector.


==== pipeline_metadata.collector.version

type: keyword

Version of the collector


==== pipeline_metadata.collector.ipaddr4

type: ip

IP address v4 of the collector server, can be an array.


==== pipeline_metadata.collector.ipaddr6

type: ip

IP address v6 of the collector server, can be an array.


==== pipeline_metadata.collector.inputname

type: keyword

how the log message was received on the collector whether it was TCP/UDP, or maybe imjournal/imfile.


==== pipeline_metadata.collector.received_at

type: date

format: yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ||yyyy-MM-dd'T'HH:mm:ssZ||dateOptionalTime

Time when the message was received at the collector.


==== pipeline_metadata.collector.original_raw_message

type: text

The original non-parsed log message, collected by collector or as close to the source as possible.



'''
[[exported-fields-pipeline_metadata.normalizer]]
=== [big]*pipeline_metadata.normalizer Fields*

The section contains metadata specific to the normalizer.



==== pipeline_metadata.normalizer.hostname

type: keyword

FQDN of the normalizer.


==== pipeline_metadata.normalizer.name

type: keyword

Name of the normalizer.


==== pipeline_metadata.normalizer.version

type: keyword

Version of the normalizer


==== pipeline_metadata.normalizer.ipaddr4

type: ip

IP address v4 of the normalizer server, can be an array.


==== pipeline_metadata.normalizer.ipaddr6

type: ip

IP address v6 of the normalizer server, can be an array.


==== pipeline_metadata.normalizer.inputname

type: keyword

how the log message was received on the normalizer whether it was TCP/UDP.


==== pipeline_metadata.normalizer.received_at

type: date

format: yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ||yyyy-MM-dd'T'HH:mm:ssZ||dateOptionalTime

Time when the message was received at the collector.


==== pipeline_metadata.normalizer.original_raw_message

type: text

The original non-parsed log message as it is received at the normalizer.


==== pipeline_metadata.trace

type: text

example: rsyslog,8.16,2016.02.01 logstash,1.5,2016.03.03

The field records the trace of the message. Each collector/normalizer appends information about itself and the date/time when the message was processed.



'''
[[exported-fields-ovirt]]
=== [big]*ovirt Fields*

Namespace for ovirt metadata.



==== ovirt.entity

type: keyword

The type of the data source, hosts, vms, engine etc.


==== ovirt.host_id

type: keyword

The oVirt host UUID.


==== ovirt.engine_fqdn

type: keyword

FQDN of the oVirt engine.


==== ovirt.cluster_name

type: keyword

Cluster name of the oVirt host.


==== ovirt.class

type: keyword

Class name of the oVirt host.


==== ovirt.module_lineno

type: keyword

Module and line number of the oVirt host.


==== ovirt.thread

type: keyword

Thread name of the oVirt host.


==== ovirt.correlationid

type: keyword

Correlation ID of the oVirt host.



'''
[[exported-fields-aushape]]
=== [big]*aushape Fields*

Audit events converted with aushape.  For more information please see https://github.com/Scribery/aushape



==== aushape.serial

type: long

Audit event serial number


==== aushape.node

type: keyword

Name of the host where the audit event occurred


==== aushape.error

type: text

The error aushape encountered while converting the event


==== aushape.trimmed

type: keyword

An array of JSONPath expressions relative to the event object, specifying objects/arrays with (some) contents removed as the result of event size limiting. Empty string means event itself. Empty array means trimming occurred at unspecified objects/arrays.


==== aushape.text

type: text

An array log record strings representing the original audit event



'''
[[exported-fields-aushape.data]]
=== [big]*aushape.data Fields*

Parsed audit event data



==== aushape.data.avc

type: nested

==== aushape.data.execve

type: text

==== aushape.data.netfilter_cfg

type: nested

==== aushape.data.obj_pid

type: nested

==== aushape.data.path

type: nested


'''
[[exported-fields-tlog]]
=== [big]*tlog Fields*

Tlog terminal I/O recording messages.  For more information please see https://github.com/Scribery/tlog



==== tlog.ver

type: long

Message format version number


==== tlog.user

type: keyword

Recorded user name


==== tlog.term

type: keyword

Terminal type name


==== tlog.session

type: long

Audit session ID of the recorded session


==== tlog.id

type: long

ID of the message within the session


==== tlog.pos

type: long

Message position in the session, milliseconds


==== tlog.timing

type: keyword

Distribution of this message's events in time


==== tlog.in_txt

type: text

Input text with invalid characters scrubbed


==== tlog.in_bin

type: short

Scrubbed invalid input characters as bytes


==== tlog.out_txt

type: text

Output text with invalid characters scrubbed


==== tlog.out_bin

type: short

Scrubbed invalid output characters as bytes


