Cloud fields
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
Fields related to the cloud or infrastructure the events are coming from.
| Field | Description | Level |
|---|---|---|
| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. type: keyword example: 666777888999  cloud.account.id |
extended |
| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. type: keyword example: elastic-dev |
extended |
| cloud.availability_zone | Availability zone in which this host, resource, or service is located. type: keyword example: us-east-1c cloud.availability_zone |
extended |
| cloud.instance.id | Instance ID of the host machine. type: keyword example: i-1234567890abcdef0 |
extended |
| cloud.instance.name | Instance name of the host machine. type: keyword |
extended |
| cloud.machine.type | Machine type of the host machine. type: keyword example: t2.medium |
extended |
| cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. type: keyword example: my-project |
extended |
| cloud.project.name | The cloud project name. Examples: Google Cloud Project name, Azure Project name. type: keyword example: my project |
extended |
| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. type: keyword example: aws cloud.provider |
extended |
| cloud.region | Region in which this host, resource, or service is located. type: keyword example: us-east-1 cloud.region |
extended |
| cloud.service.name | The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server. Examples: app engine, app service, cloud run, fargate, lambda. type: keyword example: lambda  cloud.platform |
extended |
The cloud fields are expected to be nested at:
cloud.origincloud.target
Note also that the cloud fields may be used directly at the root of the events.
| Location | Field Set | Description |
|---|---|---|
cloud.entity.* |
entity | Fields to describe various types of entities across IT environments. |
cloud.origin.* |
cloud | Provides the cloud information of the origin entity in case of an incoming request or event. |
cloud.target.* |
cloud | Provides the cloud information of the target entity in case of an outgoing request or event. |
For usage and examples of the cloud fields, please see the Cloud fields usage and examples section.