- Elastic Common Schema (ECS) Reference: other versions:
- Overview
- Using ECS
- ECS Field Reference
- Base Fields
- Agent Fields
- Autonomous System Fields
- Client Fields
- Cloud Fields
- Code Signature Fields
- Container Fields
- Destination Fields
- DLL Fields
- DNS Fields
- ECS Fields
- Error Fields
- Event Fields
- File Fields
- Geo Fields
- Group Fields
- Hash Fields
- Host Fields
- HTTP Fields
- Interface Fields
- Log Fields
- Network Fields
- Observer Fields
- Organization Fields
- Operating System Fields
- Package Fields
- PE Header Fields
- Process Fields
- Registry Fields
- Related Fields
- Rule Fields
- Server Fields
- Service Fields
- Source Fields
- Threat Fields
- TLS Fields
- Tracing Fields
- URL Fields
- User Fields
- User agent Fields
- VLAN Fields
- Vulnerability Fields
- ECS Categorization Fields
- Migrating to ECS
- Additional Information
Operating System Fields
editOperating System Fields
editThe OS fields contain information about the operating system.
Operating System Field Details
editField | Description | Level |
---|---|---|
os.family |
OS family (such as redhat, debian, freebsd, windows). type: keyword example: |
extended |
os.full |
Operating system name, including the version or code name. type: keyword Multi-fields: * os.full.text (type: text) example: |
extended |
os.kernel |
Operating system kernel version as a raw string. type: keyword example: |
extended |
os.name |
Operating system name, without the version. type: keyword Multi-fields: * os.name.text (type: text) example: |
extended |
os.platform |
Operating system platform (such centos, ubuntu, windows). type: keyword example: |
extended |
os.version |
Operating system version as a raw string. type: keyword example: |
extended |
Field Reuse
editThe os
fields are expected to be nested at: host.os
, observer.os
, user_agent.os
.
Note also that the os
fields are not expected to be used directly at the top level.
On this page