- key: beat
  title: Beat
  description: >
    Contains common beat fields available in all event types.
  fields:

    - name: beat.name
      description: >
        The name of the Beat sending the log messages. If the Beat name is
        set in the configuration file, then that value is used. If it is not
        set, the hostname is used. To set the Beat name, use the `name`
        option in the configuration file.
    - name: beat.hostname
      description: >
        The hostname as returned by the operating system on which the Beat is
        running.
    - name: beat.timezone
      description: >
        The timezone as returned by the operating system on which the Beat is
        running.
    - name: beat.version
      description: >
        The version of the beat that generated this event.

    - name: "@timestamp"
      type: date
      required: true
      format: date
      example: August 26th 2016, 12:35:53.332
      description: >
        The timestamp when the event log record was generated.

    - name: tags
      description: >
        Arbitrary tags that can be set per Beat and per transaction
        type.

    - name: fields
      type: object
      object_type: keyword
      description: >
        Contains user configurable fields.

    - name: error
      type: group
      description: >
        Error fields containing additional info in case of errors.
      fields:
        - name: message
          type: text
          description: >
            Error message.
        - name: code
          type: long
          description: >
            Error code.
        - name: type
          type: keyword
          description: >
            Error type.
- key: cloud
  title: Cloud provider metadata
  description: >
    Metadata from cloud providers added by the add_cloud_metadata processor.
  fields:

    - name: meta.cloud.provider
      example: ec2
      description: >
        Name of the cloud provider. Possible values are ec2, gce, or digitalocean.

    - name: meta.cloud.instance_id
      description: >
        Instance ID of the host machine.

    - name: meta.cloud.instance_name
      description: >
        Instance name of the host machine.

    - name: meta.cloud.machine_type
      example: t2.medium
      description: >
        Machine type of the host machine.

    - name: meta.cloud.availability_zone
      example: us-east-1c
      description: >
        Availability zone in which this host is running.

    - name: meta.cloud.project_id
      example: project-x
      description: >
        Name of the project in Google Cloud.

    - name: meta.cloud.region
      description: >
        Region in which this host is running.
- key: docker
  title: Docker
  description: >
    beta[]

    Docker stats collected from Docker.
  short_config: false
  anchor: docker-processor
  fields:
    - name: docker
      type: group
      fields:
        - name: container.id
          type: keyword
          description: >
            Unique container id.
        - name: container.image
          type: keyword
          description: >
            Name of the image the container was built on.
        - name: container.name
          type: keyword
          description: >
            Container name.
        - name: container.labels
          type: object
          object_type: keyword
          description: >
            Image labels.
- key: kubernetes
  title: Kubernetes
  description: >
    beta[]

    Kubernetes metadata added by the kubernetes processor
  short_config: false
  anchor: kubernetes-processor
  fields:
    - name: kubernetes
      type: group
      fields:
        - name: pod.name
          type: keyword
          description: >
            Kubernetes pod name

        - name: namespace
          type: keyword
          description: >
            Kubernetes namespace

        - name: labels
          type: object
          description: >
            Kubernetes labels map

        - name: annotations
          type: object
          description: >
            Kubernetes annotations map

        - name: container.name
          type: keyword
          description: >
            Kubernetes container name

        - name: container.image
          type: keyword
          description: >
            Kubernetes container image
- key: log
  title: Log file content
  description: >
    Contains log file lines.
  fields:
    - name: source
      type: keyword
      required: true
      description: >
        The file from which the line was read. This field contains the absolute path to the file.
        For example: `/var/log/system.log`.

    - name: offset
      type: long
      required: false
      description: >
        The file offset the reported line starts at.

    - name: message
      type: text
      ignore_above: 0
      required: true
      description: >
        The content of the line read from the log file.

    - name: stream
      type: keyword
      required: false
      description: >
        Log stream when reading container logs, can be 'stdout' or 'stderr'

    - name: prospector.type
      required: true
      description: >
        The prospector type from which the event was generated. This field is set to the value specified for the `type` option in the prospector section of the Filebeat config file.

    - name: read_timestamp
      description: >
        In case the ingest pipeline parses the timestamp from the log contents, it stores
        the original `@timestamp` (representing the time when the log line was read) in this
        field.

    - name: fileset.module
      description: >
        The Filebeat module that generated this event.

    - name: fileset.name
      description: >
        The Filebeat fileset that generated this event.
- key: apache2
  title: "Apache2"
  description: >
    Apache2 Module
  short_config: true
  fields:
    - name: apache2
      type: group
      description: >
        Apache2 fields.
      fields:
        - name: access
          type: group
          description: >
            Contains fields for the Apache2 HTTPD access logs.
          fields:
            - name: remote_ip
              type: keyword
              description: >
                Client IP address.
            - name: user_name
              type: keyword
              description: >
                The user name used when basic authentication is used.
            - name: method
              type: keyword
              example: GET
              description: >
                The request HTTP method.
            - name: url
              type: keyword
              description: >
                The request HTTP URL.
            - name: http_version
              type: keyword
              description: >
                The HTTP version.
            - name: response_code
              type: long
              description: >
                The HTTP response code.
            - name: body_sent.bytes
              type: long
              format: bytes
              description: >
                The number of bytes of the server response body.
            - name: referrer
              type: keyword
              description: >
                The HTTP referrer.
            - name: agent
              type: text
              description: >
                Contains the un-parsed user agent string. Only present if the user
                agent Elasticsearch plugin is not available or not used.
            - name: user_agent
              type: group
              description: >
                Contains the parsed User agent field. Only present if the user
                agent Elasticsearch plugin is available and used.
              fields:
                - name: device
                  type: keyword
                  description: >
                    The name of the physical device.
                - name: major
                  type: long
                  description: >
                    The major version of the user agent.
                - name: minor
                  type: long
                  description: >
                    The minor version of the user agent.
                - name: patch
                  type: keyword
                  description: >
                    The patch version of the user agent.
                - name: name
                  type: keyword
                  example: Chrome
                  description: >
                    The name of the user agent.
                - name: os
                  type: keyword
                  description: >
                    The name of the operating system.
                - name: os_major
                  type: long
                  description: >
                    The major version of the operating system.
                - name: os_minor
                  type: long
                  description: >
                    The minor version of the operating system.
                - name: os_name
                  type: keyword
                  description: >
                    The name of the operating system.
            - name: geoip
              type: group
              description: >
                Contains GeoIP information gathered based on the remote_ip field.
                Only present if the GeoIP Elasticsearch plugin is available and
                used.
              fields:
                - name: continent_name
                  type: keyword
                  description: >
                    The name of the continent.
                - name: country_iso_code
                  type: keyword
                  description: >
                    Country ISO code.
                - name: location
                  type: geo_point
                  description: >
                    The longitude and latitude.
                - name: region_name
                  type: keyword
                  description: >
                    The region name.
                - name: city_name
                  type: keyword
                  description: >
                    The city name.


        - name: error
          type: group
          description: >
            Fields from the Apache error logs.
          fields:
            - name: level
              type: keyword
              description: >
                The severity level of the message.
            - name: client
              type: keyword
              description: >
                The IP address of the client that generated the error.
            - name: message
              type: text
              description: >
                The logged message.
            - name: pid
              type: long
              description: >
                The process ID.
            - name: tid
              type: long
              description: >
                The thread ID.
            - name: module
              type: keyword
              description: >
                The module producing the logged message.

- key: auditd
  title: "Auditd"
  description: >
    Module for parsing auditd logs.
  short_config: true
  fields:
    - name: auditd
      type: group
      description: >
        Fields from the auditd logs.
      fields:
        - name: log
          type: group
          description: >
            Fields from the Linux audit log. Not all fields are documented here because
            they are dynamic and vary by audit event type.
          fields:
            - name: record_type
              description: >
                The audit event type.
            - name: old_auid
              description: >
                For login events this is the old audit ID used for the user prior to
                this login.
            - name: new_auid
              description: >
                For login events this is the new audit ID. The audit ID can be used to
                trace future events to the user even if their identity changes (like
                becoming root).
            - name: old_ses
              description: >
                For login events this is the old session ID used for the user prior to
                this login.
            - name: new_ses
              description: >
                For login events this is the new session ID. It can be used to tie a
                user to future events by session ID.
            - name: sequence
              type: long
              description: >
                The audit event sequence number.
            - name: acct
              description: >
                The user account name associated with the event.
            - name: pid
              description: >
                The ID of the process.
            - name: ppid
              description: >
                The ID of the process.
            - name: items
              description: >
                The number of items in an event.
            - name: item
              description: >
                The item field indicates which item out of the total number of items.
                This number is zero-based; a value of 0 means it is the first item.
            - name: a0
              description: >
                The first argument to the system call.
            - name: res
              description: >
                The result of the system call (success or failure).
            - name: geoip
              type: group
              description: >
                Contains GeoIP information gathered based on the `auditd.log.addr`
                field. Only present if the GeoIP Elasticsearch plugin is available and
                used.
              fields:
                - name: continent_name
                  type: keyword
                  description: >
                    The name of the continent.
                - name: city_name
                  type: keyword
                  description: >
                    The name of the city.
                - name: region_name
                  type: keyword
                  description: >
                    The name of the region.
                - name: country_iso_code
                  type: keyword
                  description: >
                    Country ISO code.
                - name: location
                  type: geo_point
                  description: >
                    The longitude and latitude.

- key: icinga
  title: "Icinga"
  description: >
    Icinga Module
  fields:
    - name: icinga
      type: group
      description: >
      fields:
        - name: debug
          type: group
          description: >
            Contains fields for the Icinga debug logs.
          fields:
            - name: facility
              type: keyword
              description: >
                Specifies what component of Icinga logged the message.
            - name: severity
              type: keyword
              description: >
                Possible values are "debug", "notice", "information", "warning" or
                "critical".
            - name: message
              type: text
              description: >
                The logged message.

        - name: main
          type: group
          description: >
            Contains fields for the Icinga main logs.
          fields:
            - name: facility
              type: keyword
              description: >
                Specifies what component of Icinga logged the message.
            - name: severity
              type: keyword
              description: >
                Possible values are "debug", "notice", "information", "warning" or
                "critical".
            - name: message
              type: text
              description: >
                The logged message.

        - name: startup
          type: group
          description: >
            Contains fields for the Icinga startup logs.
          fields:
            - name: facility
              type: keyword
              description: >
                Specifies what component of Icinga logged the message.
            - name: severity
              type: keyword
              description: >
                Possible values are "debug", "notice", "information", "warning" or
                "critical".
            - name: message
              type: text
              description: >
                The logged message.

- key: kafka
  title: "Kafka"
  description: >
    Kafka module
  fields:
    - name: kafka
      type: group
      description: >
      fields:
        - name: log
          type: group
          description: >
            Kafka log lines.
          fields:
            - name: timestamp
              description: >
                The timestamp from the log line.
            - name: level
              example: "WARN"
              description: >
                The log level.
            - name: message
              type: text
              description: >
                The logged message.
            - name: component
              type: keyword
              description: >
                Component the log is coming from.
            - name: class
              type: text
              description: >
                Java class the log is coming from.
            - name: trace
              type: group
              description: >
                  Trace in the log line.
              fields:
                - name: class
                  type: keyword
                  description: >
                    Java class the trace is coming from.
                - name: message
                  type: text
                  description: >
                      Message part of the trace.
                - name: full
                  type: text
                  description: >
                      The full trace in the log line.

- key: logstash
  title: "logstash"
  description: >
    logstash Module
  fields:
    - name: logstash
      type: group
      description: >
      fields:
        - name: log
          title: "Logstash"
          type: group
          description: >
            Fields from the Logstash logs.
          fields:
            - name: message
              type: text
              description: >
                Contains the un-parsed log message
            - name: level
              type: keyword
              description: >
                The log level of the message, this correspond to Log4j levels.
            - name: module
              type: keyword
              description: >
                The module or class where the event originate.
            - name: thread
              type: text
              description: >
                Information about the running thread where the log originate.
            - name: log_event
              type: object
              description: >
                key and value debugging information.


        - name: slowlog
          type: group
          description: >
            slowlog
          fields:
            - name: message
              type: text
              description: >
                Contains the un-parsed log message
            - name: level
              type: keyword
              description: >
                The log level of the message, this correspond to Log4j levels.
            - name: module
              type: keyword
              description: >
                The module or class where the event originate.
            - name: thread
              type: text
              description: >
                Information about the running thread where the log originate.
            - name: event
              type: text
              description: >
                Raw dump of the original event
            - name: plugin_name
              type: keyword
              description: >
                Name of the plugin
            - name: plugin_type
              type: keyword
              description: >
                Type of the plugin: Inputs, Filters, Outputs or Codecs.
            - name: took_in_millis
              type: long
              description: >
                Execution time for the plugin in milliseconds.
            - name: took_in_nanos
              type: long
              description: >
                Execution time for the plugin in nanoseconds.
            - name: plugin_params
              type: text
              description: >
                String value of the plugin configuration
            - name: plugin_params_object
              type: object
              description: >
                key -> value of the configuration used by the plugin.






- key: mysql
  title: "MySQL"
  description: >
    Module for parsing the MySQL log files.
  short_config: true
  fields:
    - name: mysql
      type: group
      description: >
        Fields from the MySQL log files.
      fields:
        - name: error
          type: group
          description: >
            Contains fields from the MySQL error logs.
          fields:
            - name: timestamp
              description: >
                The timestamp from the log line.
            - name: thread_id
              type: long
              description: >
                As of MySQL 5.7.2, this is the thread id. For MySQL versions prior to 5.7.2, this
                field contains the process id.
            - name: level
              example: "Warning"
              description:
                The log level.
            - name: message
              type: text
              description: >
                The logged message.

        - name: slowlog
          type: group
          description: >
            Contains fields from the MySQL slow logs.
          fields:
            - name: user
              description: >
                The MySQL user that created the query.
            - name: host
              description: >
                The host from where the user that created the query logged in.
            - name: ip
              description: >
                The IP address from where the user that created the query logged in.
            - name: query_time.sec
              type: float
              description: >
                The total time the query took, in seconds, as a floating point number.
            - name: lock_time.sec
              type: float
              description: >
                The amount of time the query waited for the lock to be available. The
                value is in seconds, as a floating point number.
            - name: rows_sent
              type: long
              description: >
                The number of rows returned by the query.
            - name: rows_examined
              type: long
              description: >
                The number of rows scanned by the query.
            - name: timestamp
              type: long
              description: >
                The unix timestamp taken from the `SET timestamp` query.
            - name: query
              description: >
                The slow query.
            - name: id
              type: long
              description: >
                The connection ID for the query.

- key: nginx
  title: "Nginx"
  description: >
    Module for parsing the Nginx log files.
  short_config: true
  fields:
    - name: nginx
      type: group
      description: >
        Fields from the Nginx log files.
      fields:
        - name: access
          type: group
          description: >
            Contains fields for the Nginx access logs.
          fields:
            - name: remote_ip_list
              type: array
              description: >
                An array of remote IP addresses. It is a list because it is common to include, besides the client
                IP address, IP addresses from headers like `X-Forwarded-For`. See also the `remote_ip` field.
            - name: remote_ip
              type: keyword
              description: >
                Client IP address. The first public IP address from the `remote_ip_list` array. If no public IP
                addresses are present, this field contains the first private IP address from the `remote_ip_list`
                array.
            - name: user_name
              type: keyword
              description: >
                The user name used when basic authentication is used.
            - name: method
              type: keyword
              example: GET
              description: >
                The request HTTP method.
            - name: url
              type: keyword
              description: >
                The request HTTP URL.
            - name: http_version
              type: keyword
              description: >
                The HTTP version.
            - name: response_code
              type: long
              description: >
                The HTTP response code.
            - name: body_sent.bytes
              type: long
              format: bytes
              description: >
                The number of bytes of the server response body.
            - name: referrer
              type: keyword
              description: >
                The HTTP referrer.
            - name: agent
              type: text
              description: >
                Contains the un-parsed user agent string. Only present if the user
                agent Elasticsearch plugin is not available or not used.
            - name: user_agent
              type: group
              description: >
                Contains the parsed User agent field. Only present if the user
                agent Elasticsearch plugin is available and used.
              fields:
                - name: device
                  type: keyword
                  description: >
                    The name of the physical device.
                - name: major
                  type: long
                  description: >
                    The major version of the user agent.
                - name: minor
                  type: long
                  description: >
                    The minor version of the user agent.
                - name: patch
                  type: keyword
                  description: >
                    The patch version of the user agent.
                - name: name
                  type: keyword
                  example: Chrome
                  description: >
                    The name of the user agent.
                - name: os
                  type: keyword
                  description: >
                    The name of the operating system.
                - name: os_major
                  type: long
                  description: >
                    The major version of the operating system.
                - name: os_minor
                  type: long
                  description: >
                    The minor version of the operating system.
                - name: os_name
                  type: keyword
                  description: >
                    The name of the operating system.
            - name: geoip
              type: group
              description: >
                Contains GeoIP information gathered based on the remote_ip field.
                Only present if the GeoIP Elasticsearch plugin is available and
                used.
              fields:
                - name: continent_name
                  type: keyword
                  description: >
                    The name of the continent.
                - name: country_iso_code
                  type: keyword
                  description: >
                    Country ISO code.
                - name: location
                  type: geo_point
                  description: >
                    The longitude and latitude.
                - name: region_name
                  type: keyword
                  description: >
                    The region name.
                - name: city_name
                  type: keyword
                  description: >
                    The city name.


        - name: error
          type: group
          description: >
            Contains fields for the Nginx error logs.
          fields:
            - name: level
              type: keyword
              description: >
                Error level (e.g. error, critical).
            - name: pid
              type: long
              description: >
                Process identifier (PID).
            - name: tid
              type: long
              description: >
                Thread identifier.
            - name: connection_id
              type: long
              description: >
                Connection identifier.
            - name: message
              type: text
              description: >
                The error message

- key: postgresql
  title: "PostgreSQL"
  description: >
    Module for parsing the PostgreSQL log files.
  short_config: true
  fields:
    - name: postgresql
      type: group
      description: >
          Fields from PostgreSQL logs.
      fields:
        - name: log
          type: group
          description: >
            Fields from the PostgreSQL log files.
          fields:
            - name: timestamp
              description: >
                The timestamp from the log line.
            - name: timezone
              description: >
                The timezone of timestamp.
            - name: thread_id
              type: long
              description: >
                  Process id
            - name: user
              example: "admin"
              description:
                Name of user
            - name: database
              example: "mydb"
              description:
                Name of database
            - name: level
              example: "FATAL"
              description:
                The log level.
            - name: duration
              type: float
              example: "30.0"
              description:
                Duration of a query.
            - name: query
              example: "SELECT * FROM users;"
              description:
                Query statement.
            - name: message
              type: text
              description: >
                The logged message.

- key: redis
  title: "Redis"
  description: >
    Redis Module
  fields:
    - name: redis
      type: group
      description: >
      fields:
        - name: log
          type: group
          description: >
            Redis log files
          fields:
            - name: pid
              type: long
              description: >
                The process ID of the Redis server.
            - name: role
              type: keyword
              description: >
                The role of the Redis instance. Can be one of `master`, `slave`, `child` (for RDF/AOF writing child),
                or `sentinel`.
            - name: level
              type: keyword
              description: >
                The log level. Can be one of `debug`, `verbose`, `notice`, or `warning`.
            - name: message
              type: text
              description: >
                The log message

        - name: slowlog
          type: group
          description: >
            Slow logs are retrieved from Redis via a network connection.
          fields:
            - name: cmd
              type: keyword
              description: >
                The command executed.
            - name: duration.us
              type: long
              description: >
                How long it took to execute the command in microseconds.
            - name: id
              type: long
              description: >
                The ID of the query.
            - name: key
              type: keyword
              description: >
                The key on which the command was executed.
            - name: args
              type: keyword
              description: >
                The arguments with which the command was called.

- key: system
  title: "System"
  description: >
    Module for parsing system log files.
  short_config: true
  fields:
    - name: system
      type: group
      description: >
        Fields from the system log files.
      fields:
        - name: auth
          type: group
          description: >
            Fields from the Linux authorization logs.
          fields:
            - name: timestamp
              description: >
                The timestamp as read from the auth message.
            - name: hostname
              description: >
                The hostname as read from the auth message.
            - name: program
              description: >
                The process name as read from the auth message.
            - name: pid
              type: long
              description: >
                The PID of the process that sent the auth message.
            - name: message
              description: >
                The message in the log line.
            - name: user
              description: >
                The Unix user that this event refers to.

            - name: ssh
              type: group
              description: >
                Fields specific to SSH login events.
              fields:
              - name: event
                description: >
                  The SSH login event. Can be one of "Accepted", "Failed", or "Invalid". "Accepted"
                  means a successful login. "Invalid" means that the user is not configured on the
                  system. "Failed" means that the SSH login attempt has failed.
              - name: method
                description: >
                  The SSH authentication method. Can be one of "password" or "publickey".
              - name: ip
                type: ip
                description: >
                  The client IP from where the login attempt was made.
              - name: dropped_ip
                type: ip
                description: >
                  The client IP from SSH connections that are open and immediately dropped.
              - name: port
                type: long
                description: >
                  The client port from where the login attempt was made.
              - name: signature
                description: >
                  The signature of the client public key.
              - name: geoip
                type: group
                description: >
                  Contains GeoIP information gathered based on the `system.auth.ip` field.
                  Only present if the GeoIP Elasticsearch plugin is available and
                  used.
                fields:
                  - name: continent_name
                    type: keyword
                    description: >
                      The name of the continent.
                  - name: city_name
                    type: keyword
                    description: >
                      The name of the city.
                  - name: region_name
                    type: keyword
                    description: >
                      The name of the region.
                  - name: country_iso_code
                    type: keyword
                    description: >
                      Country ISO code.
                  - name: location
                    type: geo_point
                    description: >
                      The longitude and latitude.

            - name: sudo
              type: group
              description: >
                Fields specific to events created by the `sudo` command.
              fields:
              - name: error
                example: user NOT in sudoers
                description: >
                  The error message in case the sudo command failed.
              - name: tty
                description: >
                  The TTY where the sudo command is executed.
              - name: pwd
                description: >
                  The current directory where the sudo command is executed.
              - name: user
                example: root
                description: >
                  The target user to which the sudo command is switching.
              - name: command
                description: >
                  The command executed via sudo.

            - name: useradd
              type: group
              description: >
                Fields specific to events created by the `useradd` command.
              fields:
              - name: name
                description: >
                  The user name being added.
              - name: uid
                type: long
                description:
                  The user ID.
              - name: gid
                type: long
                description:
                  The group ID.
              - name: home
                description:
                  The home folder for the new user.
              - name: shell
                description:
                  The default shell for the new user.

            - name: groupadd
              type: group
              description: >
                Fields specific to events created by the `groupadd` command.
              fields:
              - name: name
                description: >
                  The name of the new group.
              - name: gid
                type: long
                description: >
                  The ID of the new group.

        - name: syslog
          type: group
          description: >
            Contains fields from the syslog system logs.
          fields:
            - name: timestamp
              description: >
                The timestamp as read from the syslog message.
            - name: hostname
              description: >
                The hostname as read from the syslog message.
            - name: program
              description: >
                The process name as read from the syslog message.
            - name: pid
              description: >
                The PID of the process that sent the syslog message.
            - name: message
              description: >
                The message in the log line.

- key: traefik
  title: "Traefik"
  description: >
    Module for parsing the Traefik log files.
  fields:
    - name: traefik
      type: group
      description: >
        Fields from the Traefik log files.
      fields:
        - name: access
          type: group
          description: >
            Contains fields for the Traefik access logs.
          fields:
            - name: remote_ip
              type: keyword
              description: >
                Client IP address.
            - name: user_name
              type: keyword
              description: >
                The user name used when basic authentication is used.
            - name: method
              type: keyword
              example: GET
              description: >
                The request HTTP method.
            - name: url
              type: keyword
              description: >
                The request HTTP URL.
            - name: http_version
              type: keyword
              description: >
                The HTTP version.
            - name: response_code
              type: long
              description: >
                The HTTP response code.
            - name: body_sent.bytes
              type: long
              format: bytes
              description: >
                The number of bytes of the server response body.
            - name: referrer
              type: keyword
              description: >
                The HTTP referrer.
            - name: agent
              type: text
              description: >
                Contains the un-parsed user agent string. Only present if the user
                agent Elasticsearch plugin is not available or not used.
            - name: user_agent
              type: group
              description: >
                Contains the parsed User agent field. Only present if the user
                agent Elasticsearch plugin is available and used.
              fields:
                - name: device
                  type: keyword
                  description: >
                    The name of the physical device.
                - name: major
                  type: long
                  description: >
                    The major version of the user agent.
                - name: minor
                  type: long
                  description: >
                    The minor version of the user agent.
                - name: patch
                  type: keyword
                  description: >
                    The patch version of the user agent.
                - name: name
                  type: keyword
                  example: Chrome
                  description: >
                    The name of the user agent.
                - name: os
                  type: keyword
                  description: >
                    The name of the operating system.
                - name: os_major
                  type: long
                  description: >
                    The major version of the operating system.
                - name: os_minor
                  type: long
                  description: >
                    The minor version of the operating system.
                - name: os_name
                  type: keyword
                  description: >
                    The name of the operating system.
            - name: geoip
              type: group
              description: >
                Contains GeoIP information gathered based on the remote_ip field.
                Only present if the GeoIP Elasticsearch plugin is available and
                used.
              fields:
                - name: continent_name
                  type: keyword
                  description: >
                    The name of the continent.
                - name: country_iso_code
                  type: keyword
                  description: >
                    Country ISO code.
                - name: location
                  type: geo_point
                  description: >
                    The longitude and latitude.
                - name: region_name
                  type: keyword
                  description: >
                    The region name.
                - name: city_name
                  type: keyword
                  description: >
                    The city name.
            - name: request_count
              type: long
              description: >
                The number of requests
            - name: frontend_name
              type: text
              description: >
                The name of the frontend used
            - name: backend_url
              type: text
              description:
                The url of the backend where request is forwarded