ECS Field Reference
Service
ECS Version:

Service

Fields describing the service for or from which the data was collected.

Fields

Field Summary

FieldTypeLevelDescription
service.addresskeywordExtendedAddress of this service.
service.environmentkeywordExtendedEnvironment of the service.
service.ephemeral_idkeywordExtendedEphemeral identifier of this service.
service.idkeywordCoreUnique identifier of the running service.
service.namekeywordCoreName of the service.
service.node.namekeywordExtendedName of the service node.
service.node.rolekeywordExtendedDeprecated role (singular) of the service node.
service.node.roleskeywordExtendedRoles of the service node.
service.origin.addresskeywordExtendedAddress of this service.
service.origin.environmentkeywordExtendedEnvironment of the service.
service.origin.ephemeral_idkeywordExtendedEphemeral identifier of this service.
service.origin.idkeywordCoreUnique identifier of the running service.
service.origin.namekeywordCoreName of the service.
service.origin.node.namekeywordExtendedName of the service node.
service.origin.node.rolekeywordExtendedDeprecated role (singular) of the service node.
service.origin.node.roleskeywordExtendedRoles of the service node.
service.origin.statekeywordCoreCurrent state of the service.
service.origin.typekeywordCoreThe type of the service.
service.origin.versionkeywordCoreVersion of the service.
service.statekeywordCoreCurrent state of the service.
service.target.addresskeywordExtendedAddress of this service.
service.target.environmentkeywordExtendedEnvironment of the service.
service.target.ephemeral_idkeywordExtendedEphemeral identifier of this service.
service.target.idkeywordCoreUnique identifier of the running service.
service.target.namekeywordCoreName of the service.
service.target.node.namekeywordExtendedName of the service node.
service.target.node.rolekeywordExtendedDeprecated role (singular) of the service node.
service.target.node.roleskeywordExtendedRoles of the service node.
service.target.statekeywordCoreCurrent state of the service.
service.target.typekeywordCoreThe type of the service.
service.target.versionkeywordCoreVersion of the service.
service.typekeywordCoreThe type of the service.
service.versionkeywordCoreVersion of the service.

Field Details

service.address

Type: keyword

Level: Extended

Description: Address of this service.

Example: 172.26.0.2:5432

Indexed: true

service.environment

Type: keyword

Level: Extended

Description: Environment of the service.

Example: production

Indexed: true

service.ephemeral_id

Type: keyword

Level: Extended

Description: Ephemeral identifier of this service.

Example: 8a4f500f

Indexed: true

service.id

Type: keyword

Level: Core

Description: Unique identifier of the running service.

Example: d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6

Indexed: true

service.name

Type: keyword

Level: Core

Description: Name of the service.

Example: elasticsearch-metrics

Indexed: true

service.node.name

Type: keyword

Level: Extended

Description: Name of the service node.

Example: instance-0000000016

Indexed: true

service.node.role

Type: keyword

Level: Extended

Description: Deprecated role (singular) of the service node.

Example: background_tasks

Indexed: true

service.node.roles

Type: keyword

Level: Extended

Description: Roles of the service node.

Example: ["ui", "background_tasks"]

Normalization: array

Indexed: true

service.origin.address

Type: keyword

Level: Extended

Description: Address of this service.

Example: 172.26.0.2:5432

Indexed: true

service.origin.environment

Type: keyword

Level: Extended

Description: Environment of the service.

Example: production

Indexed: true

service.origin.ephemeral_id

Type: keyword

Level: Extended

Description: Ephemeral identifier of this service.

Example: 8a4f500f

Indexed: true

service.origin.id

Type: keyword

Level: Core

Description: Unique identifier of the running service.

Example: d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6

Indexed: true

service.origin.name

Type: keyword

Level: Core

Description: Name of the service.

Example: elasticsearch-metrics

Indexed: true

service.origin.node.name

Type: keyword

Level: Extended

Description: Name of the service node.

Example: instance-0000000016

Indexed: true

service.origin.node.role

Type: keyword

Level: Extended

Description: Deprecated role (singular) of the service node.

Example: background_tasks

Indexed: true

service.origin.node.roles

Type: keyword

Level: Extended

Description: Roles of the service node.

Example: ["ui", "background_tasks"]

Normalization: array

Indexed: true

service.origin.state

Type: keyword

Level: Core

Description: Current state of the service.

Indexed: true

service.origin.type

Type: keyword

Level: Core

Description: The type of the service.

Example: elasticsearch

Indexed: true

service.origin.version

Type: keyword

Level: Core

Description: Version of the service.

Example: 3.2.4

Indexed: true

service.state

Type: keyword

Level: Core

Description: Current state of the service.

Indexed: true

service.target.address

Type: keyword

Level: Extended

Description: Address of this service.

Example: 172.26.0.2:5432

Indexed: true

service.target.environment

Type: keyword

Level: Extended

Description: Environment of the service.

Example: production

Indexed: true

service.target.ephemeral_id

Type: keyword

Level: Extended

Description: Ephemeral identifier of this service.

Example: 8a4f500f

Indexed: true

service.target.id

Type: keyword

Level: Core

Description: Unique identifier of the running service.

Example: d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6

Indexed: true

service.target.name

Type: keyword

Level: Core

Description: Name of the service.

Example: elasticsearch-metrics

Indexed: true

service.target.node.name

Type: keyword

Level: Extended

Description: Name of the service node.

Example: instance-0000000016

Indexed: true

service.target.node.role

Type: keyword

Level: Extended

Description: Deprecated role (singular) of the service node.

Example: background_tasks

Indexed: true

service.target.node.roles

Type: keyword

Level: Extended

Description: Roles of the service node.

Example: ["ui", "background_tasks"]

Normalization: array

Indexed: true

service.target.state

Type: keyword

Level: Core

Description: Current state of the service.

Indexed: true

service.target.type

Type: keyword

Level: Core

Description: The type of the service.

Example: elasticsearch

Indexed: true

service.target.version

Type: keyword

Level: Core

Description: Version of the service.

Example: 3.2.4

Indexed: true

service.type

Type: keyword

Level: Core

Description: The type of the service.

Example: elasticsearch

Indexed: true

service.version

Type: keyword

Level: Core

Description: Version of the service.

Example: 3.2.4

Indexed: true