- Elastic Common Schema (ECS) Reference: other versions:
- Overview
- Using ECS
- ECS Field Reference
- Base Fields
- Agent Fields
- Autonomous System Fields
- Client Fields
- Cloud Fields
- Code Signature Fields
- Container Fields
- Data Stream Fields
- Destination Fields
- DLL Fields
- DNS Fields
- ECS Fields
- ELF Header Fields
- Email Fields
- Error Fields
- Event Fields
- FaaS Fields
- File Fields
- Geo Fields
- Group Fields
- Hash Fields
- Host Fields
- HTTP Fields
- Interface Fields
- Log Fields
- Network Fields
- Observer Fields
- Orchestrator Fields
- Organization Fields
- Operating System Fields
- Package Fields
- PE Header Fields
- Process Fields
- Registry Fields
- Related Fields
- Rule Fields
- Server Fields
- Service Fields
- Source Fields
- Threat Fields
- TLS Fields
- Tracing Fields
- URL Fields
- User Fields
- User agent Fields
- VLAN Fields
- Vulnerability Fields
- x509 Certificate Fields
- ECS Categorization Fields
- Migrating to ECS
- Additional Information
- Release Notes
Container Fields
editContainer Fields
editContainer fields are used for meta information about the specific container that is the source of information.
These fields help correlate data based containers from any runtime.
Container Field Details
editField | Description | Level |
---|---|---|
[beta] This field is beta and subject to change. Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1. Scaling factor: 1000. type: scaled_float |
extended |
|
[beta] This field is beta and subject to change. The total number of bytes (gauge) read successfully (aggregated from all disks) since the last metric collection. type: long |
extended |
|
[beta] This field is beta and subject to change. The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection. type: long |
extended |
|
Unique container id. type: keyword |
core |
|
Name of the image the container was built on. type: keyword |
extended |
|
Container image tags. type: keyword Note: this field should contain an array of values. |
extended |
|
Image labels. type: object |
extended |
|
[beta] This field is beta and subject to change. Memory usage percentage and it ranges from 0 to 1. Scaling factor: 1000. type: scaled_float |
extended |
|
Container name. type: keyword |
extended |
|
[beta] This field is beta and subject to change. The number of bytes (gauge) sent out on all network interfaces by the container since the last metric collection. type: long |
extended |
|
[beta] This field is beta and subject to change. The number of bytes received (gauge) on all network interfaces by the container since the last metric collection. type: long |
extended |
|
Runtime managing this container. type: keyword example: |
extended |
On this page