ECS Field Reference
ECS 1.12
Container
⚠️ Outdated Version: You are viewing ECS version 1.12, which is outdated. View the latest version (9.0)
ECS Version:

Container

Fields describing the container that generated this event.

Fields

Field Summary

FieldTypeLevelDescription
container.idkeywordCoreUnique container id.
container.image.namekeywordExtendedName of the image the container was built on.
container.image.tagkeywordExtendedContainer image tags.
container.labelsobjectExtendedImage labels.
container.namekeywordExtendedContainer name.
container.runtimekeywordExtendedRuntime managing this container.

Field Details

container.id

Type: keyword

Level: Core

Description: Unique container id.

Indexed: true

container.image.name

Type: keyword

Level: Extended

Description: Name of the image the container was built on.

Indexed: true

container.image.tag

Type: keyword

Level: Extended

Description: Container image tags.

Normalization: array

Indexed: true

container.labels

Type: object

Level: Extended

Description: Image labels.

Indexed: true

container.name

Type: keyword

Level: Extended

Description: Container name.

Indexed: true

container.runtime

Type: keyword

Level: Extended

Description: Runtime managing this container.

Example: docker

Indexed: true