ECS::LogEntry::Destination
Inherits JSON::Serializable < Struct < Value < Object
Constructors
Instance methods
destination.address
Some event destination addresses are defined ambiguously. The event will
sometimes list an IP, a domain or a unix socket. You should always store the raw
address in the .address field.
Then it should be duplicated to .ip or .domain, depending on which one it
is.
Level: Extended Type: Keyword
destination.address
Some event destination addresses are defined ambiguously. The event will
sometimes list an IP, a domain or a unix socket. You should always store the raw
address in the .address field.
Then it should be duplicated to .ip or .domain, depending on which one it
is.
Level: Extended Type: Keyword
destination.bytes
Bytes sent from the destination to the source.
Level: Core Type: Long Example:
184
destination.bytes
Bytes sent from the destination to the source.
Level: Core Type: Long Example:
184
destination.domain
Destination domain.
Level: Core Type: Keyword
destination.ip
IP address of the destination (IPv4 or IPv6).
Level: Core Type: IP
destination.mac
MAC address of the destination.
Level: Core Type: Keyword
destination.packets
Packets sent from the destination to the source.
Level: Core Type: Long Example:
12
destination.packets
Packets sent from the destination to the source.
Level: Core Type: Long Example:
12
destination.registered_domain
The highest registered destination domain, stripped of the subdomain.
For example, the registered domain for "foo.google.com" is "google.com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".
Level: Extended Type: Keyword Example:
google.com
destination.registered_domain
The highest registered destination domain, stripped of the subdomain.
For example, the registered domain for "foo.google.com" is "google.com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".
Level: Extended Type: Keyword Example:
google.com
destination.top_level_domain
The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for google.com is "com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".
Level: Extended Type: Keyword Example:
co.uk
destination.top_level_domain
The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for google.com is "com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".
Level: Extended Type: Keyword Example:
co.uk