System fields
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
Module for parsing system log files.
Fields from the system log files.
Fields from the Linux authorization logs.
system.auth.timestamp-
type: alias
alias to: @timestamp
system.auth.hostname-
type: alias
alias to: host.hostname
system.auth.program-
type: alias
alias to: process.name
system.auth.pid-
type: alias
alias to: process.pid
system.auth.message-
type: alias
alias to: message
system.auth.user-
type: alias
alias to: user.name
system.auth.ssh.method- The SSH authentication method. Can be one of "password" or "publickey".
system.auth.ssh.signature- The signature of the client public key.
system.auth.ssh.dropped_ip-
The client IP from SSH connections that are open and immediately dropped.
type: ip
system.auth.ssh.event-
The SSH event as found in the logs (Accepted, Invalid, Failed, etc.)
example: Accepted
system.auth.ssh.ip-
type: alias
alias to: source.ip
system.auth.ssh.port-
type: alias
alias to: source.port
system.auth.ssh.geoip.continent_name-
type: alias
alias to: source.geo.continent_name
system.auth.ssh.geoip.country_iso_code-
type: alias
alias to: source.geo.country_iso_code
system.auth.ssh.geoip.location-
type: alias
alias to: source.geo.location
system.auth.ssh.geoip.region_name-
type: alias
alias to: source.geo.region_name
system.auth.ssh.geoip.city_name-
type: alias
alias to: source.geo.city_name
system.auth.ssh.geoip.region_iso_code-
type: alias
alias to: source.geo.region_iso_code
Fields specific to events created by the sudo command.
system.auth.sudo.error-
The error message in case the sudo command failed.
example: user NOT in sudoers
system.auth.sudo.tty- The TTY where the sudo command is executed.
system.auth.sudo.pwd- The current directory where the sudo command is executed.
system.auth.sudo.user-
The target user to which the sudo command is switching.
example: root
system.auth.sudo.command- The command executed via sudo.
Fields specific to events created by the useradd command.
system.auth.useradd.home- The home folder for the new user.
system.auth.useradd.shell- The default shell for the new user.
system.auth.useradd.name-
type: alias
alias to: user.name
system.auth.useradd.uid-
type: alias
alias to: user.id
system.auth.useradd.gid-
type: alias
alias to: group.id
Fields specific to events created by the groupadd command.
system.auth.groupadd.name-
type: alias
alias to: group.name
system.auth.groupadd.gid-
type: alias
alias to: group.id
Contains fields from the syslog system logs.
system.syslog.timestamp-
type: alias
alias to: @timestamp
system.syslog.hostname-
type: alias
alias to: host.hostname
system.syslog.program-
type: alias
alias to: process.name
system.syslog.pid-
type: alias
alias to: process.pid
system.syslog.message-
type: alias
alias to: message