- Elastic Common Schema (ECS) Reference: other versions:
- Overview
- Using ECS
- ECS Field Reference
- Base Fields
- Agent Fields
- Autonomous System Fields
- Client Fields
- Cloud Fields
- Code Signature Fields
- Container Fields
- Destination Fields
- DLL Fields
- DNS Fields
- ECS Fields
- Error Fields
- Event Fields
- File Fields
- Geo Fields
- Group Fields
- Hash Fields
- Host Fields
- HTTP Fields
- Interface Fields
- Log Fields
- Network Fields
- Observer Fields
- Organization Fields
- Operating System Fields
- Package Fields
- PE Header Fields
- Process Fields
- Registry Fields
- Related Fields
- Rule Fields
- Server Fields
- Service Fields
- Source Fields
- Threat Fields
- TLS Fields
- Tracing Fields
- URL Fields
- User Fields
- User agent Fields
- VLAN Fields
- Vulnerability Fields
- ECS Categorization Fields
- Migrating to ECS
- Additional Information
HTTP Fields
editHTTP Fields
editFields related to HTTP activity. Use the url
field set to store the url of the request.
HTTP Field Details
editField | Description | Level |
---|---|---|
http.request.body.bytes |
Size in bytes of the request body. type: long example: |
extended |
http.request.body.content |
The full HTTP request body. type: keyword Multi-fields: * http.request.body.content.text (type: text) example: |
extended |
http.request.bytes |
Total size in bytes of the request (body and headers). type: long example: |
extended |
http.request.method |
HTTP request method. The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS". type: keyword example: |
extended |
http.request.referrer |
Referrer for this HTTP request. type: keyword example: |
extended |
http.response.body.bytes |
Size in bytes of the response body. type: long example: |
extended |
http.response.body.content |
The full HTTP response body. type: keyword Multi-fields: * http.response.body.content.text (type: text) example: |
extended |
http.response.bytes |
Total size in bytes of the response (body and headers). type: long example: |
extended |
http.response.status_code |
HTTP response status code. type: long example: |
extended |
http.version |
HTTP version. type: keyword example: |
extended |
On this page