Client
Fields about the client side of a network connection, used with server.
Fields
Field Summary
| Field | Type | Level | Description |
|---|---|---|---|
client.address | keyword | Extended | Client network address. |
client.as.number | long | Extended | Unique number allocated to the autonomous system. |
client.as.organization.name | keyword | Extended | Organization name. |
client.as.organization.name.text | match_only_text | Extended | Organization name. |
client.bytes | long | Core | Bytes sent from the client to the server. |
client.domain | keyword | Core | The domain name of the client. |
client.geo.city_name | keyword | Core | City name. |
client.geo.continent_code | keyword | Core | Continent code. |
client.geo.continent_name | keyword | Core | Name of the continent. |
client.geo.country_iso_code | keyword | Core | Country ISO code. |
client.geo.country_name | keyword | Core | Country name. |
client.geo.location | geo_point | Core | Longitude and latitude. |
client.geo.name | keyword | Extended | User-defined description of a location. |
client.geo.postal_code | keyword | Core | Postal code. |
client.geo.region_iso_code | keyword | Core | Region ISO code. |
client.geo.region_name | keyword | Core | Region name. |
client.geo.timezone | keyword | Core | Time zone. |
client.ip | ip | Core | IP address of the client. |
client.mac | keyword | Core | MAC address of the client. |
client.nat.ip | ip | Extended | Client NAT ip address |
client.nat.port | long | Extended | Client NAT port |
client.packets | long | Core | Packets sent from the client to the server. |
client.port | long | Core | Port of the client. |
client.registered_domain | keyword | Extended | The highest registered client domain, stripped of the subdomain. |
client.subdomain | keyword | Extended | The subdomain of the domain. |
client.top_level_domain | keyword | Extended | The effective top level domain (com, org, net, co.uk). |
client.user.domain | keyword | Extended | Name of the directory the user is a member of. |
client.user.email | keyword | Extended | User email address. |
client.user.full_name | keyword | Extended | User's full name, if available. |
client.user.full_name.text | match_only_text | Extended | User's full name, if available. |
client.user.group.domain | keyword | Extended | Name of the directory the group is a member of. |
client.user.group.id | keyword | Extended | Unique identifier for the group on the system/platform. |
client.user.group.name | keyword | Extended | Name of the group. |
client.user.hash | keyword | Extended | Unique user hash to correlate information for a user in anonymized form. |
client.user.id | keyword | Core | Unique identifier of the user. |
client.user.name | keyword | Core | Short name or login of the user. |
client.user.name.text | match_only_text | Core | Short name or login of the user. |
client.user.roles | keyword | Extended | Array of user roles at the time of the event. |
Field Details
client.address
Type: keyword
Level: Extended
Description: Client network address.
Indexed: true
client.as.number
Type: long
Level: Extended
Description: Unique number allocated to the autonomous system.
Example: 15169
Indexed: true
client.as.organization.name
Type: keyword
Level: Extended
Description: Organization name.
Example: Google LLC
Indexed: true
client.as.organization.name.text
Type: match_only_text
Level: Extended
Description: Organization name.
Example: Google LLC
Indexed: true
client.bytes
Type: long
Level: Core
Description: Bytes sent from the client to the server.
Example: 184
Indexed: true
client.domain
Type: keyword
Level: Core
Description: The domain name of the client.
Example: foo.example.com
Indexed: true
client.geo.city_name
Type: keyword
Level: Core
Description: City name.
Example: Montreal
Indexed: true
client.geo.continent_code
Type: keyword
Level: Core
Description: Continent code.
Example: NA
Indexed: true
client.geo.continent_name
Type: keyword
Level: Core
Description: Name of the continent.
Example: North America
Indexed: true
client.geo.country_iso_code
Type: keyword
Level: Core
Description: Country ISO code.
Example: CA
Indexed: true
client.geo.country_name
Type: keyword
Level: Core
Description: Country name.
Example: Canada
Indexed: true
client.geo.location
Type: geo_point
Level: Core
Description: Longitude and latitude.
Example: { "lon": -73.614830, "lat": 45.505918 }
Indexed: true
client.geo.name
Type: keyword
Level: Extended
Description: User-defined description of a location.
Example: boston-dc
Indexed: true
client.geo.postal_code
Type: keyword
Level: Core
Description: Postal code.
Example: 94040
Indexed: true
client.geo.region_iso_code
Type: keyword
Level: Core
Description: Region ISO code.
Example: CA-QC
Indexed: true
client.geo.region_name
Type: keyword
Level: Core
Description: Region name.
Example: Quebec
Indexed: true
client.geo.timezone
Type: keyword
Level: Core
Description: Time zone.
Example: America/Argentina/Buenos_Aires
Indexed: true
client.ip
Type: ip
Level: Core
Description: IP address of the client.
Indexed: true
client.mac
Type: keyword
Level: Core
Description: MAC address of the client.
Example: 00-00-5E-00-53-23
Indexed: true
client.nat.ip
Type: ip
Level: Extended
Description: Client NAT ip address
Indexed: true
client.nat.port
Type: long
Level: Extended
Description: Client NAT port
Indexed: true
client.packets
Type: long
Level: Core
Description: Packets sent from the client to the server.
Example: 12
Indexed: true
client.port
Type: long
Level: Core
Description: Port of the client.
Indexed: true
client.registered_domain
Type: keyword
Level: Extended
Description: The highest registered client domain, stripped of the subdomain.
Example: example.com
Indexed: true
client.subdomain
Type: keyword
Level: Extended
Description: The subdomain of the domain.
Example: east
Indexed: true
client.top_level_domain
Type: keyword
Level: Extended
Description: The effective top level domain (com, org, net, co.uk).
Example: co.uk
Indexed: true
client.user.domain
Type: keyword
Level: Extended
Description: Name of the directory the user is a member of.
Indexed: true
client.user.email
Type: keyword
Level: Extended
Description: User email address.
Indexed: true
client.user.full_name
Type: keyword
Level: Extended
Description: User's full name, if available.
Example: Albert Einstein
Indexed: true
client.user.full_name.text
Type: match_only_text
Level: Extended
Description: User's full name, if available.
Example: Albert Einstein
Indexed: true
client.user.group.domain
Type: keyword
Level: Extended
Description: Name of the directory the group is a member of.
Indexed: true
client.user.group.id
Type: keyword
Level: Extended
Description: Unique identifier for the group on the system/platform.
Indexed: true
client.user.group.name
Type: keyword
Level: Extended
Description: Name of the group.
Indexed: true
client.user.hash
Type: keyword
Level: Extended
Description: Unique user hash to correlate information for a user in anonymized form.
Indexed: true
client.user.id
Type: keyword
Level: Core
Description: Unique identifier of the user.
Example: S-1-5-21-202424912787-2692429404-2351956786-1000
Indexed: true
client.user.name
Type: keyword
Level: Core
Description: Short name or login of the user.
Example: a.einstein
Indexed: true
client.user.name.text
Type: match_only_text
Level: Core
Description: Short name or login of the user.
Example: a.einstein
Indexed: true
client.user.roles
Type: keyword
Level: Extended
Description: Array of user roles at the time of the event.
Example: ["kibana_admin", "reporting_user"]
Normalization: array
Indexed: true