Version 1.0
Field Name
Data Type
user.name
text
agent.type
text
client.ip
text
destination.as.organization.name
text
destination.geo.city_name
text
destination.geo.continent_code
text
destination.geo.country_code
text
destination.geo.country_name
text
destination.geo.location.lat
geopoint
destination.geo.location.lon
geopoint
destination.geo.region_name
text
destination.locality
text
event.action
text
event.category
array
event.created
date
event.dataset
text
event.id
text
event.kind
text
event.module
text
event.original
text
event.outcome
text
event.severity
text
event.type
array
http.host
text
http.referrer
text
http.request.method
text
http.request.referrer
text
http.uri
text
http.version
text
log.type
text
message
text
network.direction
int
network.protocol
ip
observer.type
text
organisation.id
text
related.hash
array
related.hosts
array
related.ip
array
related.user
array
sensor.id
text
server.ip
text
source.as.number
text
source.as.organization.name
text
source.geo.city_name
text
source.geo.continent_code
text
source.geo.country_code
text
source.geo.country_name
text
source.geo.location.lat
geopoint
source.geo.location.lon
geopoint
source.geo.region_name
text
source.locality
text
threatintel.days
int
threatintel.entity
text
threatintel.event_data
text
threatintel.lookup
text
threatintel.malware.malware
text
threatintel.malware.timestamp
date/time
threatintel.severity
text
threatintel.tags
text
threatintel.white_list
text
user_agent.original
text
uuid
text
