struct

ECS::LogEntry

Inherits JSON::Serializable < Struct < Value < Object

The top-level of an ECS log entry.

Constructors

new(pull : JSON::PullParser)

Source

new

Initialize all values as nil

Source

new(*, __pull_for_json_serializable pull : JSON::PullParser)

Source

Instance methods

agent(value : Agent)

A chainable setter for agent

Source

agent

Source

agent

Initialize a new Agent, yield it to the block

Source

agent=(agent : Agent | Nil)

Source

client(value : Client)

A chainable setter for client

Source

client

Source

client

Initialize a new Client, yield it to the block

Source

client=(client : Client | Nil)

Source

cloud(value : Cloud)

A chainable setter for cloud

Source

cloud

Source

cloud

Initialize a new Cloud, yield it to the block

Source

cloud=(cloud : Cloud | Nil)

Source

container(value : Container)

A chainable setter for container

Source

container

Source

container

Initialize a new Container, yield it to the block

Source

container=(container : Container | Nil)

Source

destination(value : Destination)

A chainable setter for destination

Source

destination

Source

destination

Initialize a new Destination, yield it to the block

Source

destination=(destination : Destination | Nil)

Source

dll(value : Dll)

A chainable setter for dll

Source

dll

Source

dll

Initialize a new Dll, yield it to the block

Source

dll=(dll : Dll | Nil)

Source

dns(value : Dns)

A chainable setter for dns

Source

dns

Source

dns

Initialize a new Dns, yield it to the block

Source

dns=(dns : Dns | Nil)

Source

ecs(value : Ecs)

A chainable setter for ecs

Source

ecs

Source

ecs

Initialize a new Ecs, yield it to the block

Source

ecs=(ecs : Ecs | Nil)

Source

error(value : Error)

A chainable setter for error

Source

error

Source

error

Initialize a new Error, yield it to the block

Source

error=(error : Error | Nil)

Source

event(value : Event)

A chainable setter for event

Source

event

Source

event

Initialize a new Event, yield it to the block

Source

event=(event : Event | Nil)

Source

file(value : File)

A chainable setter for file

Source

file

Source

file

Initialize a new File, yield it to the block

Source

file=(file : File | Nil)

Source

group(value : Group)

A chainable setter for group

Source

group

Source

group

Initialize a new Group, yield it to the block

Source

group=(group : Group | Nil)

Source

host(value : Host)

A chainable setter for host

Source

host

Source

host

Initialize a new Host, yield it to the block

Source

host=(host : Host | Nil)

Source

http(value : Http)

A chainable setter for http

Source

http

Source

http

Initialize a new Http, yield it to the block

Source

http=(http : Http | Nil)

Source

labels(new_value : Hash(String, String))

A chainable setter for labels

Source

labels

Custom key/value pairs.

Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword.

Example: docker and k8s labels.

Level: Core Type: Object Object Type: Keyword Example:

{"application": "foo-bar", "env": "production"}

Source

labels=(labels : Hash(String, String) | Nil)

labels

Custom key/value pairs.

Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword.

Example: docker and k8s labels.

Level: Core Type: Object Object Type: Keyword Example:

{"application": "foo-bar", "env": "production"}

Source

log(value : Log)

A chainable setter for log

Source

log

Source

log

Initialize a new Log, yield it to the block

Source

log=(log : Log | Nil)

Source

message(new_value : String)

A chainable setter for message

Source

message

For log events the message field contains the log message, optimized for viewing in a log viewer.

For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.

If multiple messages exist, they can be combined into one message.

Level: Core Type: Text Example:

Hello World

Source

message=(message : String | Nil)

message

For log events the message field contains the log message, optimized for viewing in a log viewer.

For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.

If multiple messages exist, they can be combined into one message.

Level: Core Type: Text Example:

Hello World

Source

network(value : Network)

A chainable setter for network

Source

network

Source

network

Initialize a new Network, yield it to the block

Source

network=(network : Network | Nil)

Source

observer(value : Observer)

A chainable setter for observer

Source

observer

Source

observer

Initialize a new Observer, yield it to the block

Source

observer=(observer : Observer | Nil)

Source

organization(value : Organization)

A chainable setter for organization

Source

organization

Source

organization

Initialize a new Organization, yield it to the block

Source

organization=(organization : Organization | Nil)

Source

package(value : Package)

A chainable setter for package

Source

package

Source

package

Initialize a new Package, yield it to the block

Source

package=(package : Package | Nil)

Source

process(value : Process)

A chainable setter for process

Source

process

Source

process

Initialize a new Process, yield it to the block

Source

process=(process : Process | Nil)

Source

registry(value : Registry)

A chainable setter for registry

Source

registry

Source

registry

Initialize a new Registry, yield it to the block

Source

registry=(registry : Registry | Nil)

Source

rule(value : Rule)

A chainable setter for rule

Source

rule

Source

rule

Initialize a new Rule, yield it to the block

Source

rule=(rule : Rule | Nil)

Source

server(value : Server)

A chainable setter for server

Source

server

Source

server

Initialize a new Server, yield it to the block

Source

server=(server : Server | Nil)

Source

service(value : Service)

A chainable setter for service

Source

service

Source

service

Initialize a new Service, yield it to the block

Source

service=(service : Service | Nil)

Source

source(value : Source)

A chainable setter for source

Source

source

Source

source

Initialize a new Source, yield it to the block

Source

source=(source : Source | Nil)

Source

tags(new_value : String)

A chainable setter for tags

Source

tags

List of keywords used to tag each event.

Level: Core Type: Keyword Example:

["production", "env2"]

Source

threat(value : Threat)

A chainable setter for threat

Source

threat

Source

threat

Initialize a new Threat, yield it to the block

Source

threat=(threat : Threat | Nil)

Source

timestamp(new_value : Time)

A chainable setter for timestamp

Source

timestamp

@timestamp

Date/time when the event originated.

This is the date/time extracted from the event, typically representing when the event was generated by the source.

If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.

Required field for all events.

Level: Core Type: Date Example:

2016-05-23T08:05:34.853Z

Source

timestamp=(timestamp : Time | Nil)

@timestamp

Date/time when the event originated.

This is the date/time extracted from the event, typically representing when the event was generated by the source.

If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.

Required field for all events.

Level: Core Type: Date Example:

2016-05-23T08:05:34.853Z

Source

tls(value : Tls)

A chainable setter for tls

Source

tls

Source

tls

Initialize a new Tls, yield it to the block

Source

tls=(tls : Tls | Nil)

Source

trace(value : Trace)

A chainable setter for trace

Source

trace

Source

trace

Initialize a new Trace, yield it to the block

Source

trace=(trace : Trace | Nil)

Source

transaction(value : Transaction)

A chainable setter for transaction

Source

transaction

Source

transaction

Initialize a new Transaction, yield it to the block

Source

transaction=(transaction : Transaction | Nil)

Source

url(value : Url)

A chainable setter for url

Source

url

Source

url

Initialize a new Url, yield it to the block

Source

url=(url : Url | Nil)

Source

user(value : User)

A chainable setter for user

Source

user

Source

user

Initialize a new User, yield it to the block

Source

user=(user : User | Nil)

Source

useragent(value : UserAgent)

A chainable setter for useragent

Source

useragent

Source

useragent

Initialize a new UserAgent, yield it to the block

Source

useragent=(useragent : UserAgent | Nil)

Source

vulnerability(value : Vulnerability)

A chainable setter for vulnerability

Source

vulnerability

Source

vulnerability

Initialize a new Vulnerability, yield it to the block

Source

vulnerability=(vulnerability : Vulnerability | Nil)

Source

Constructors

Instance methods

Nested types