Common fields
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
Contains common fields available in all event types.
File attributes.
file.setuid-
Set if the file has the
setuidbit set. Omitted otherwise.type: boolean
example: True
file.setgid-
Set if the file has the
setgidbit set. Omitted otherwise.type: boolean
example: True
file.origin-
An array of strings describing a possible external origin for this file. For example, the URL it was downloaded from. Only supported in macOS, via the kMDItemWhereFroms attribute. Omitted if origin information is not available.
type: keyword
file.origin.text-
This is an analyzed field that is useful for full text search on the origin data.
type: text
The SELinux identity of the file.
file.selinux.user-
The owner of the object.
type: keyword
file.selinux.role-
The object's SELinux role.
type: keyword
file.selinux.domain-
The object's SELinux domain or type.
type: keyword
file.selinux.level-
The object's SELinux level.
type: keyword
example: s0
file.extended_attributesThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.2 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.-
Extended file attributes. Contains NTFS Extended Attributes (EAs) on Windows systems. Extended Attributes are name-value pairs that can be attached to files and directories to store additional metadata beyond standard file attributes. The object contains key-value pairs where keys are EA names and values are their corresponding values. This field is only populated on Windows and only when the file has extended attributes.
type: flattened
User information.
Audit user information.
user.audit.id-
Audit user ID.
type: keyword
user.audit.name-
Audit user name.
type: keyword
Filesystem user information.
user.filesystem.id-
Filesystem user ID.
type: keyword
user.filesystem.name-
Filesystem user name.
type: keyword
Filesystem group information.
user.filesystem.group.id-
Filesystem group ID.
type: keyword
user.filesystem.group.name-
Filesystem group name.
type: keyword
Saved user information.
user.saved.id-
Saved user ID.
type: keyword
user.saved.name-
Saved user name.
type: keyword
Saved group information.
user.saved.group.id-
Saved group ID.
type: keyword
user.saved.group.name-
Saved group name.
type: keyword