Entity Reference fields
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
A reusable set of identifier fields used to reference other entities in relationship contexts. Each field holds a keyword array of identifiers following the same conventions as the corresponding ECS root field. Only the fields defined in this field set might appear, ad-hoc or integration-specific property names are not allowed.
This field set is alpha and subject to change.
| Field | Description | Level |
|---|---|---|
| entity_reference.entity.id | Identifiers of referenced entities, using the same meaning as root entity.id (stable id for correlation within scope).type: keyword Note: This field should contain an array of values. |
extended |
| entity_reference.host.id | Referenced host ids. type: keyword Note: This field should contain an array of values. |
extended |
| entity_reference.host.name | Referenced host names. type: keyword Note: This field should contain an array of values. |
extended |
| entity_reference.service.id | Referenced service ids. type: keyword Note: This field should contain an array of values. |
extended |
| entity_reference.service.name | Referenced service names. type: keyword Note: This field should contain an array of values. |
extended |
| entity_reference.user.domain | Referenced user directory or AD/LDAP domain names (same semantics as ECS user.domain).type: keyword Note: This field should contain an array of values. |
extended |
| entity_reference.user.email | Referenced user email addresses. type: keyword Note: This field should contain an array of values. |
extended |
| entity_reference.user.id | Referenced user ids. type: keyword Note: This field should contain an array of values. |
extended |
| entity_reference.user.name | Referenced user short names or logins. type: keyword Note: This field should contain an array of values. |
extended |
The entity_reference fields are expected to be nested at:
entity.relationships.administersentity.relationships.depends_onentity.relationships.ownsentity.relationships.supervises
Note also that the entity_reference fields are not expected to be used directly at the root of the events.