Version 1.0
\
Field Name
Data Type
ads.service.app_language
text
ads.service.app_remote
text
ads.service.arch_remote
text
ads.service.audit_action
text
ads.service.client_remote
text
ads.service.client_response
text
ads.service.command
text
ads.service.command_args
text
ads.service.community_string
text
ads.service.database_name
text
ads.service.filename
text
ads.service.host_domain
text
ads.service.host_remote
text
ads.service.log_msg
text
ads.service.name_local
text
ads.service.name_remote
text
ads.service.opcode
text
ads.service.repo_name
text
ads.service.request_call_id
text
ads.service.request_contact
text
ads.service.request_content_length
int
ads.service.request_cseq
text
ads.service.request_from
text
ads.service.request_max_forwards
int
ads.service.request_mime_type
text
ads.service.request_oid
text
ads.service.request_to
text
ads.service.request_via
text
ads.service.server_address
text
ads.service.server_challenge
text
ads.service.session_id
text
ads.service.share_filename
text
ads.service.share_name
text
ads.service.status
text
ads.service.transfer_mode
text
ads.service.url_domain
text
ads.service.url_path
text
ads.service.user_agent
text
ads.service.user_name
text
ads.service.user_password
text
ads.service.version_local
text
ads.service.version_remote
text
ads.service.web_module
text
ads.token.auth
text
ads.token.channel
text
ads.token.id
text
ads.token.manage_url
text
ads.token.reminder_text
text
ads.token.text
text
ads.token.type
text
ads.token.user_agent
text
agent.hostname
text
agent.type
text
destination.as.number
text
destination.as.organization.name
text
destination.geo.city_name
text
destination.geo.continent_code
text
destination.geo.country_code
text
destination.geo.country_name
text
destination.geo.location.lat
geopoint
destination.geo.location.lon
geopoint
destination.geo.region_name
text
destination.ip
ip
destination.locality
text
destination.port
int
event.action
text
event.category
array
event.code
int
event.created
date/time
event.dataset
text
event.kind
text
event.module
text
event.original
text
event.provider
text
event.type
array
file.directory
text
file.path
text
http.request.body.content
text
http.request.lang
text
http.request.method
text
http.request.mime_type
text
http.response.status_code
int
input.type
text
log.file.path
text
message
text
network.community.id
text
node.name
text
observer.as.number
text
observer.as.organization.name
text
observer.geo.city_name
text
observer.geo.continent_code
text
observer.geo.country_code
text
observer.geo.country_name
text
observer.geo.location.lat
geopoint
observer.geo.location.lon
geopoint
observer.geo.region_name
text
observer.hostname
text
observer.interface
text
observer.ip
ip
observer.locality
text
observer.mac
text
observer.type
text
observer.version
text
organization.id
text
related.hash
array
related.hosts
array
related.ip
array
related.user
array
sensor.id
text
service.address
ip
service.name
text
service.type
text
source.as.number
text
source.as.organization.name
text
source.geo.city_name
text
source.geo.continent_code
text
source.geo.country_code
text
source.geo.country_name
text
source.geo.location.lat
geopoint
source.geo.location.lon
geopoint
source.geo.region_name
text
source.ip
ip
source.locality
text
source.port
int
threat.indicator.lookup
text
threat.indicator.type
ip
threatintel.days
int
threatintel.entity
text
threatintel.event_data
text
threatintel.lookup
text
threatintel.malware.malware
text
threatintel.malware.timestamp
date/time
threatintel.severity
text
threatintel.tags
text
threatintel.white_list
text
url.domain
text
url.path
text
user.name
text
user.password
text
user_agent.original
text
uuid
text