- Elastic Common Schema (ECS) Reference: other versions:
- Overview
- Using ECS
- ECS Field Reference
- Base Fields
- Agent Fields
- Autonomous System Fields
- Client Fields
- Cloud Fields
- Code Signature Fields
- Container Fields
- Data Stream Fields
- Destination Fields
- DLL Fields
- DNS Fields
- ECS Fields
- ELF Header Fields
- Email Fields
- Error Fields
- Event Fields
- FaaS Fields
- File Fields
- Geo Fields
- Group Fields
- Hash Fields
- Host Fields
- HTTP Fields
- Interface Fields
- Log Fields
- Network Fields
- Observer Fields
- Orchestrator Fields
- Organization Fields
- Operating System Fields
- Package Fields
- PE Header Fields
- Process Fields
- Registry Fields
- Related Fields
- Rule Fields
- Server Fields
- Service Fields
- Source Fields
- Threat Fields
- TLS Fields
- Tracing Fields
- URL Fields
- User Fields
- User agent Fields
- VLAN Fields
- Vulnerability Fields
- x509 Certificate Fields
- ECS Categorization Fields
- Migrating to ECS
- Additional Information
- Release Notes
Cloud Fields
editCloud Fields
editFields related to the cloud or infrastructure the events are coming from.
Cloud Field Details
editField | Description | Level |
---|---|---|
The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. type: keyword example: |
extended |
|
The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. type: keyword example: |
extended |
|
Availability zone in which this host, resource, or service is located. type: keyword example: |
extended |
|
Instance ID of the host machine. type: keyword example: |
extended |
|
Instance name of the host machine. type: keyword |
extended |
|
Machine type of the host machine. type: keyword example: |
extended |
|
The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. type: keyword example: |
extended |
|
The cloud project name. Examples: Google Cloud Project name, Azure Project name. type: keyword example: |
extended |
|
Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. type: keyword example: |
extended |
|
Region in which this host, resource, or service is located. type: keyword example: |
extended |
|
The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server. Examples: app engine, app service, cloud run, fargate, lambda. type: keyword example: |
extended |
Field Reuse
editThe cloud
fields are expected to be nested at:
-
cloud.origin
-
cloud.target
Note also that the cloud
fields may be used directly at the root of the events.
Field sets that can be nested under Cloud
editLocation | Field Set | Description |
---|---|---|
|
[beta]
Reusing the Provides the cloud information of the origin entity in case of an incoming request or event. |
|
|
[beta]
Reusing the Provides the cloud information of the target entity in case of an outgoing request or event. |
Cloud Field Usage
editFor usage and examples of the cloud fields, please see the Cloud Fields Usage and Examples section.
On this page