- Elastic Common Schema (ECS) Reference: other versions:
- Overview
- Using ECS
- ECS Field Reference
- Base Fields
- Agent Fields
- Autonomous System Fields
- Client Fields
- Cloud Fields
- Code Signature Fields
- Container Fields
- Data Stream Fields
- Destination Fields
- Device Fields
- DLL Fields
- DNS Fields
- ECS Fields
- ELF Header Fields
- Email Fields
- Error Fields
- Event Fields
- FaaS Fields
- File Fields
- Geo Fields
- Group Fields
- Hash Fields
- Host Fields
- HTTP Fields
- Interface Fields
- Log Fields
- Mach-O Header Fields
- Network Fields
- Observer Fields
- Orchestrator Fields
- Organization Fields
- Operating System Fields
- Package Fields
- PE Header Fields
- Process Fields
- Registry Fields
- Related Fields
- Risk information Fields
- Rule Fields
- Server Fields
- Service Fields
- Source Fields
- Threat Fields
- TLS Fields
- Tracing Fields
- URL Fields
- User Fields
- User agent Fields
- VLAN Fields
- Volume Fields
- Vulnerability Fields
- x509 Certificate Fields
- ECS Categorization Fields
- Migrating to ECS
- Additional Information
- Release Notes
Volume Fields
editVolume Fields
editFields related to storage volume details.
These fields are beta and are subject to change.
Volume Field Details
editField | Description | Level |
---|---|---|
Bus type of the device, such as type: keyword example: |
extended |
|
Describes the default access(es) of the volume. type: keyword |
extended |
|
Full path of the volume device. Only populate this field for POSIX system volumes. type: keyword |
extended |
|
Volume device type. The most frequently seen volume device types are type: keyword example: |
extended |
|
The MS-DOS name of a device. DOS device name is in the format of driver letters, such as type: keyword example: |
extended |
|
Volume device file system type. The most common volume file system types are type: keyword |
extended |
|
Mount name of the volume device. Only populate this field for POSIX system volumes. type: keyword |
extended |
|
The NT device name. NT device name uses a format of type: keyword example: |
extended |
|
ProductID of the device. The vendor provides the ProductID for the volume, if any. type: keyword |
extended |
|
Product name of the volume. The volume device vendor provides this value. type: keyword example: |
extended |
|
Indicates if the volume is removable. type: boolean |
extended |
|
Serial number identifier for the volume device. The serial number is provided by the vendor of the device, if any. type: keyword |
extended |
|
Size of the volume device in bytes. type: long |
extended |
|
VendorID of the volume device. The volume device vendor provides this value. type: keyword |
extended |
|
Vendor name of the volume device. The value is provided by the vendor of the device. type: keyword example: |
extended |
|
Indicates if the volume is writable. type: boolean |
extended |
On this page