Container fields
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
Container fields are used for meta information about the specific container that is the source of information.
These fields help correlate data based containers from any runtime.
| Field | Description | Level |
|---|---|---|
| container.cpu.usage | Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1. Scaling factor: 1000. type: scaled_float   container.cpu.usage |
extended |
| container.disk.read.bytes | The total number of bytes (gauge) read successfully (aggregated from all disks) since the last metric collection. type: long |
extended |
| container.disk.write.bytes | The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection. type: long |
extended |
| container.id | Unique container id. type: keyword  container.id |
core |
| container.image.hash.all | An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: algorithm:value. Algorithm names should align with the field names in the ECS hash field set.type: keyword Note: This field should contain an array of values. example: [sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]  container.image.repo_digests |
extended |
| container.image.name | Name of the image the container was built on. type: keyword container.image.name |
extended |
| container.image.tag | Container image tags. type: keyword Note: This field should contain an array of values. container.image.tags |
extended |
| container.labels | Image labels. type: object  container.label |
extended |
| container.memory.usage | Memory usage percentage and it ranges from 0 to 1. Scaling factor: 1000. type: scaled_float container.memory.usage |
extended |
| container.name | Container name. type: keyword container.name |
extended |
| container.network.egress.bytes | The number of bytes (gauge) sent out on all network interfaces by the container since the last metric collection. type: long |
extended |
| container.network.ingress.bytes | The number of bytes received (gauge) on all network interfaces by the container since the last metric collection. type: long |
extended |
| container.runtime | Runtime managing this container. type: keyword example: docker container.runtime.name |
extended |
| container.security_context.privileged | Indicates whether the container is running in privileged mode. type: boolean |
extended |