- Elastic Common Schema (ECS) Reference: other versions:
- Overview
- Using ECS
- ECS Field Reference
- Base Fields
- Agent Fields
- Autonomous System Fields
- Client Fields
- Cloud Fields
- Code Signature Fields
- Container Fields
- Destination Fields
- DLL Fields
- DNS Fields
- ECS Fields
- Error Fields
- Event Fields
- File Fields
- Geo Fields
- Group Fields
- Hash Fields
- Host Fields
- HTTP Fields
- Interface Fields
- Log Fields
- Network Fields
- Observer Fields
- Organization Fields
- Operating System Fields
- Package Fields
- PE Header Fields
- Process Fields
- Registry Fields
- Related Fields
- Rule Fields
- Server Fields
- Service Fields
- Source Fields
- Threat Fields
- TLS Fields
- Tracing Fields
- URL Fields
- User Fields
- User agent Fields
- VLAN Fields
- Vulnerability Fields
- x509 Certificate Fields
- ECS Categorization Fields
- Migrating to ECS
- Additional Information
User Fields
editUser Fields
editThe user fields describe information about the user that is relevant to the event.
Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
Find additional usage and examples in the user fields usage section.
User Field Details
editField | Description | Level |
---|---|---|
Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. type: keyword |
extended |
|
User email address. type: keyword |
extended |
|
User’s full name, if available. type: keyword Multi-fields: * user.full_name.text (type: text) example: |
extended |
|
Unique user hash to correlate information for a user in anonymized form. Useful if type: keyword |
extended |
|
Unique identifier of the user. type: keyword |
core |
|
Short name or login of the user. type: keyword Multi-fields: * user.name.text (type: text) example: |
core |
|
Array of user roles at the time of the event. type: keyword Note: this field should contain an array of values. example: |
extended |
Field Reuse
editThe user
fields are expected to be nested at: client.user
, destination.user
, host.user
, server.user
, source.user
, user.changes
, user.effective
, user.target
.
Note also that the user
fields may be used directly at the root of the events.
Field sets that can be nested under User
editNested fields | Description |
---|---|
[beta] Reusing the user fields in this location is currently considered beta. Fields to describe the user relevant to the event. |
|
[beta] Reusing the user fields in this location is currently considered beta. Fields to describe the user relevant to the event. |
|
User’s group relevant to the event. |
|
[beta] Reusing the user fields in this location is currently considered beta. Fields to describe the user relevant to the event. |