Move all icinga related fields to an icinga group

fixes #25
fixes #26
fixes #28

_meta/fields.yml

@@ -12,6 +12,24 @@
       description: >
         Type of the document
 
+    - name: icinga
+      type: group
+      fields:
+        - name: timestamp
+          type: date
+          description: >
+            Timestamp of event occurrence
+
+        - name: type
+          type: keyword
+          description: >
+            Type of the document
+
+        - name: host
+          type: keyword
+          description: >
+            Host that triggered the event
+
         - name: service
           type: keyword
           description: >
@@ -117,6 +135,11 @@
           description: >
             State of the check
 
+        - name: check_result.ttl
+          type: integer
+          description: >
+            TTL, only valid if passive check
+
         - name: check_result.type
           type: keyword
           description: >

beater/eventstream.go

@@ -51,35 +51,35 @@ func BuildEventstreamEvent(e []byte) beat.Event {
 	event.Fields = common.MapStr{}
 
 	for key, value := range icingaEvent {
-		event.Fields.Put(key, value)
+		event.Fields.Put(target_key + key, value)
 	}
 
 	logp.Debug("icingabeat", "Type: %v", icingaEvent["type"])
 	switch icingaEvent["type"] {
 	case "CheckResult", "StateChange", "Notification":
 		checkResult := icingaEvent["check_result"].(map[string]interface{})
-		event.Fields.Put("check_result.execution_start", FloatToTimestamp(checkResult["execution_start"].(float64)))
-		event.Fields.Put("check_result.execution_end", FloatToTimestamp(checkResult["execution_end"].(float64)))
-		event.Fields.Put("check_result.schedule_start", FloatToTimestamp(checkResult["schedule_start"].(float64)))
-		event.Fields.Put("check_result.schedule_end", FloatToTimestamp(checkResult["schedule_end"].(float64)))
+		event.Fields.Put(target_key + "check_result.execution_start", FloatToTimestamp(checkResult["execution_start"].(float64)))
+		event.Fields.Put(target_key + "check_result.execution_end", FloatToTimestamp(checkResult["execution_end"].(float64)))
+		event.Fields.Put(target_key + "check_result.schedule_start", FloatToTimestamp(checkResult["schedule_start"].(float64)))
+		event.Fields.Put(target_key + "check_result.schedule_end", FloatToTimestamp(checkResult["schedule_end"].(float64)))
 		event.Fields.Delete("check_result.performance_data")
 
 	case "AcknowledgementSet":
 		event.Delete("comment")
-		event.Fields.Put("comment.text", icingaEvent["comment"])
-		event.Fields.Put("expiry", FloatToTimestamp(icingaEvent["expiry"].(float64)))
+		event.Fields.Put(target_key + "comment.text", icingaEvent["comment"])
+		event.Fields.Put(target_key + "expiry", FloatToTimestamp(icingaEvent["expiry"].(float64)))
 
 	case "CommentAdded", "CommentRemoved":
 		comment := icingaEvent["comment"].(map[string]interface{})
-		event.Fields.Put("comment.entry_time", FloatToTimestamp(comment["entry_time"].(float64)))
-		event.Fields.Put("comment.expire_time", FloatToTimestamp(comment["expire_time"].(float64)))
+		event.Fields.Put(target_key + "comment.entry_time", FloatToTimestamp(comment["entry_time"].(float64)))
+		event.Fields.Put(target_key + "comment.expire_time", FloatToTimestamp(comment["expire_time"].(float64)))
 
 	case "DowntimeAdded", "DowntimeRemoved", "DowntimeStarted", "DowntimeTriggered":
 		downtime := icingaEvent["downtime"].(map[string]interface{})
-		event.Fields.Put("downtime.end_time", FloatToTimestamp(downtime["end_time"].(float64)))
-		event.Fields.Put("downtime.entry_time", FloatToTimestamp(downtime["entry_time"].(float64)))
-		event.Fields.Put("downtime.start_time", FloatToTimestamp(downtime["start_time"].(float64)))
-		event.Fields.Put("downtime.trigger_time", FloatToTimestamp(downtime["trigger_time"].(float64)))
+		event.Fields.Put(target_key + "downtime.end_time", FloatToTimestamp(downtime["end_time"].(float64)))
+		event.Fields.Put(target_key + "downtime.entry_time", FloatToTimestamp(downtime["entry_time"].(float64)))
+		event.Fields.Put(target_key + "downtime.start_time", FloatToTimestamp(downtime["start_time"].(float64)))
+		event.Fields.Put(target_key + "downtime.trigger_time", FloatToTimestamp(downtime["trigger_time"].(float64)))
 	}
 
 	event.Fields.Put("type", "icingabeat.event."+strings.ToLower(icingaEvent["type"].(string)))

beater/icingabeat.go

@@ -17,6 +17,8 @@ type Icingabeat struct {
 	client beat.Client
 }
 
+var target_key = "icinga."
+
 // New beater
 func New(b *beat.Beat, cfg *common.Config) (beat.Beater, error) {
 	config := config.DefaultConfig

beater/statuspoller.go

@@ -65,11 +65,11 @@ func BuildStatusEvents(body []byte) []beat.Event {
 										delete(value.(map[string]interface{}), "zones")
 									}
 								}
-								event.Fields.Put(key, value)
+								event.Fields.Put(target_key + key, value)
 							}
 
 						default:
-							event.Fields.Put(key, value)
+							event.Fields.Put(target_key + key, value)
 						}
 
 					}
@@ -83,22 +83,21 @@ func BuildStatusEvents(body []byte) []beat.Event {
 						case interface{}:
 							key = "perfdata." + perfdata.(map[string]interface{})["label"].(string)
 							value = perfdata
-							event.Fields.Put(key, value)
+							event.Fields.Put(target_key + key, value)
 
 						}
 					}
 
 				case "name":
-					key = "type"
 					value = "icingabeat.status." + strings.ToLower(value.(string))
-					event.Fields.Put(key, value)
+					event.Fields.Put("type", value)
 
 				default:
-					event.Fields.Put(key, value)
+					event.Fields.Put(target_key + key, value)
 				}
 			}
 
-			if statusAvailable, _ := event.Fields.HasKey("status"); statusAvailable == true {
+			if statusAvailable, _ := event.Fields.HasKey(target_key + "status"); statusAvailable == true {
 				statusEvents = append(statusEvents, event)
 			}
 		}

fields.yml

@@ -0,0 +1,901 @@
+- key: icingabeat
+  title: icingabeat
+  description: Data received from the Icinga 2 API
+  fields:
+    - name: timestamp
+      type: date
+      description: >
+        Timestamp of event occurrence
+
+    - name: type
+      type: keyword
+      description: >
+        Type of the document
+
+    - name: icinga
+      type: group
+      fields:
+        - name: timestamp
+          type: date
+          description: >
+            Timestamp of event occurrence
+
+        - name: type
+          type: keyword
+          description: >
+            Type of the document
+
+        - name: host
+          type: keyword
+          description: >
+            Host that triggered the event
+
+        - name: service
+          type: keyword
+          description: >
+            Service that triggered the event
+
+        - name: state
+          type: integer
+          description: >
+            State of the check
+
+        - name: state_type
+          type: integer
+          description: >
+            State type of the check
+
+        - name: author
+          type: keyword
+          description: >
+            Author of a message
+
+        - name: notification_type
+          type: keyword
+          description: >
+            Type of notification
+
+        - name: text
+          type: text
+          description: >
+            Text of a message
+
+        - name: users
+          type: keyword
+          description: >
+            Affected users of a notification
+
+        - name: acknowledgement_type
+          type: integer
+          description: >
+            Type of an acknowledgement
+
+        - name: expiry
+          type: date
+          description: >
+            Expiry of an acknowledgement
+
+        - name: notify
+          type: keyword
+          description: >
+            If has been sent out
+
+        - name: check_result.active
+          type: boolean
+          description: >
+            If check was active or passive
+
+        - name: check_result.check_source
+          type: keyword
+          description: >
+            Icinga instance that scheduled the check
+
+        - name: check_result.command
+          type: text
+          description: >
+            Command that was executed
+
+        - name: check_result.execution_end
+          type: date
+          description: >
+            Time when execution of check ended
+
+        - name: check_result.execution_start
+          type: date
+          description: >
+            Time when execution of check started
+
+        - name: check_result.exit_status
+          type: integer
+          description: >
+            Exit status
+
+        - name: check_result.output
+          type: text
+          description: >
+            Output of check
+
+        - name: check_result.performance_data
+          type: text
+          description: >
+            Performance data in text format
+
+        - name: check_result.schedule_end
+          type: date
+          description: >
+            Time when scheduling of the check ended
+
+        - name: check_result.schedule_start
+          type: date
+          description: >
+            Time when check was scheduled
+
+        - name: check_result.state
+          type: integer
+          description: >
+            State of the check
+
+        - name: check_result.ttl
+          type: integer
+          description: >
+            TTL, only valid if passive check
+
+        - name: check_result.type
+          type: keyword
+          description: >
+            Type of this event
+
+        - name: check_result.vars_after.attempt
+          type: integer
+          description: >
+            Check attempt after check execution
+
+        - name: check_result.vars_after.reachable
+          type: boolean
+          description: >
+            Reachable state after check execution
+
+        - name: check_result.vars_after.state
+          type: integer
+          description: >
+            State of the check after execution
+
+        - name: check_result.vars_after.state_type
+          type: integer
+          description: >
+            State type after execution
+
+        - name: check_result.vars_before.attempt
+          type: integer
+          description: >
+            Check attempt before check execution
+
+        - name: check_result.vars_before.reachable
+          type: boolean
+          description: >
+            Reachable state before check execution
+
+        - name: check_result.vars_before.state
+          type: integer
+          description: >
+            Check state before check execution
+
+        - name: check_result.vars_before.state_type
+          type: integer
+          description: >
+            State type before check execution
+
+        - name: comment.__name
+          type: text
+          description: >
+            Unique identifier of a comment
+
+        - name: comment.author
+          type: keyword
+          description: >
+            Author of a comment
+
+        - name: comment.entry_time
+          type: date
+          description: >
+            Entry time of a comment
+
+        - name: comment.entry_type
+          type: integer
+          description: >
+            Entry type of a comment
+
+        - name: comment.expire_time
+          type: date
+          description: >
+            Expire time of a comment
+
+        - name: comment.host_name
+          type: keyword
+          description: >
+            Host name of a comment
+
+        - name: comment.legacy_id
+          type: integer
+          description: >
+            Legacy ID of a comment
+
+        - name: comment.name
+          type: keyword
+          description: >
+            Identifier of a comment
+
+        - name: comment.package
+          type: keyword
+          description: >
+            Config package of a comment
+
+        - name: comment.service_name
+          type: keyword
+          description: >
+            Service name of a comment
+
+        - name: comment.templates
+          type: text
+          description: >
+            Templates used by a comment
+
+        - name: comment.text
+          type: text
+          description: >
+            Text of a comment
+
+        - name: comment.type
+          type: keyword
+          description: >
+            Comment type
+
+        - name: comment.version
+          type: keyword
+          description: >
+            Config version of comment object
+
+        - name: comment.zone
+          type: keyword
+          description: >
+            Zone where comment was generated
+
+        - name: downtime.__name
+          type: text
+          description: >
+            Unique identifier of a downtime
+
+        - name: downtime.author
+          type: keyword
+          description: >
+            Author of a downtime
+
+        - name: downtime.comment
+          type: text
+          description: >
+            Text of a downtime
+
+        - name: downtime.config_owner
+          type: text
+          description: >
+            Config owner
+
+        - name: downtime.duration
+          type: integer
+          description: >
+            Duration of a downtime
+
+        - name: downtime.end_time
+          type: date
+          description: >
+            Timestamp of downtime end
+
+        - name: downtime.entry_time
+          type: date
+          description: >
+            Timestamp when downtime was created
+
+        - name: downtime.fixed
+          type: boolean
+          description: >
+            If downtime is fixed or flexible
+
+        - name: downtime.host_name
+          type: keyword
+          description: >
+            Hostname of a downtime
+
+        - name: downtime.legacy_id
+          type: integer
+          description: >
+            The integer ID of a downtime
+
+        - name: downtime.name
+          type: keyword
+          description: >
+            Downtime config identifier
+
+        - name: downtime.package
+          type: keyword
+          description: >
+            Configuration package of downtime
+
+        - name: downtime.scheduled_by
+          type: text
+          description: >
+            By whom downtime was scheduled
+
+        - name: downtime.service_name
+          type: keyword
+          description: >
+            Service name of a downtime
+
+        - name: downtime.start_time
+          type: date
+          description: >
+            Timestamp when downtime starts
+
+        - name: downtime.templates
+          type: text
+          description: >
+            Templates used by this downtime
+
+        - name: downtime.trigger_time
+          type: date
+          description: >
+            Timestamp when downtime was triggered
+
+        - name: downtime.triggered_by
+          type: text
+          description: >
+            By whom downtime was triggered
+
+        - name: downtime.triggers
+          type: text
+          description: >
+            Downtime triggers
+
+        - name: downtime.type
+          type: keyword
+          description: >
+            Downtime type
+
+        - name: downtime.version
+          type: keyword
+          description: >
+            Config version of downtime
+
+        - name: downtime.was_cancelled
+          type: boolean
+          description: >
+            If downtime was cancelled
+
+        - name: downtime.zone
+          type: keyword
+          description: >
+            Zone of downtime
+
+        - name: status.active_host_checks
+          type: integer
+          description: >
+            Active host checks
+
+
+        - name: status.active_host_checks_15min
+          type: integer
+          description: >
+            Active host checks in the last 15 minutes
+
+
+        - name: status.active_host_checks_1min
+          type: integer
+          description: >
+            Acitve host checks in the last minute
+
+
+        - name: status.active_host_checks_5min
+          type: integer
+          description: >
+            Active host checks in the last 5 minutes
+
+
+        - name: status.active_service_checks
+          type: integer
+          description: >
+            Active service checks
+
+        - name: status.active_service_checks_15min
+          type: integer
+          description: >
+            Active service checks in the last 15 minutes
+
+        - name: status.active_service_checks_1min
+          type: integer
+          description: >
+            Active service checks in the last minute
+
+        - name: status.active_service_checks_5min
+          type: integer
+          description: >
+            Active service checks in the last 5 minutes
+
+        - name: status.api.identity
+          type: keyword
+          description: >
+            API identity
+
+        - name: status.api.num_conn_endpoints
+          type: integer
+          description: >
+            Number of connected endpoints
+
+        - name: status.api.num_endpoints
+          type: integer
+          description: >
+            Total number of endpoints
+
+        - name: status.api.num_not_conn_endpoints
+          type: integer
+          description: >
+            Number of not connected endpoints
+
+        - name: status.avg_execution_time
+          type: integer
+          description: >
+            Average execution time of checks
+
+        - name: status.avg_latency
+          type: integer
+          description: >
+            Average latency time
+
+        - name: status.checkercomponent.checker.idle
+          type: integer
+          description: >
+            Idle checks
+
+        - name: status.checkercomponent.checker.pending
+          type: integer
+          description: >
+            Pending checks
+
+        - name: status.filelogger.main-log
+          type: integer
+          description: >
+            Mainlog enabled
+
+        - name: status.icingaapplication.app.enable_event_handlers
+          type: boolean
+          description: >
+            Event handlers enabled
+
+        - name: status.icingaapplication.app.enable_flapping
+          type: boolean
+          description: >
+            Flapping detection enabled
+
+        - name: status.icingaapplication.app.enable_host_checks
+          type: boolean
+          description: >
+            Host checks enabled
+
+        - name: status.icingaapplication.app.enable_notifications
+          type: boolean
+          description: >
+            Notifications enabled
+
+        - name: status.icingaapplication.app.enable_perfdata
+          type: boolean
+          description: >
+            Perfdata enabled
+
+        - name: status.icingaapplication.app.enable_service_checks
+          type: boolean
+          description: >
+            Service checks enabled
+
+        - name: status.icingaapplication.app.node_name
+          type: keyword
+          description: >
+            Node name
+
+        - name: status.icingaapplication.app.pid
+          type: integer
+          description: >
+            PID
+
+        - name: status.icingaapplication.app.program_start
+          type: integer
+          description: >
+            Time when Icinga started
+
+        - name: status.icingaapplication.app.version
+          type: keyword
+          description: >
+            Version
+
+        - name: status.idomysqlconnection.ido-mysql.connected
+          type: boolean
+          description: >
+            IDO connected
+
+        - name: status.idomysqlconnection.ido-mysql.instance_name
+          type: keyword
+          description: >
+            IDO Instance name
+
+        - name: status.idomysqlconnection.ido-mysql.query_queue_items
+          type: integer
+          description: >
+            IDO query items in the queue
+
+        - name: status.idomysqlconnection.ido-mysql.version
+          type: keyword
+          description: >
+            IDO schema version
+
+        - name: status.max_execution_time
+          type: integer
+          description: >
+            Max execution time
+
+        - name: status.max_latency
+          type: integer
+          description: >
+            Max latency
+
+        - name: status.min_execution_time
+          type: integer
+          description: >
+            Min execution time
+
+        - name: status.min_latency
+          type: integer
+          description: >
+            Min latency
+
+        - name: status.notificationcomponent.notification
+          type: integer
+          description: >
+            Notification
+
+        - name: status.num_hosts_acknowledged
+          type: integer
+          description: >
+            Amount of acknowledged hosts
+
+        - name: status.num_hosts_down
+          type: integer
+          description: >
+            Amount of down hosts
+
+        - name: status.num_hosts_flapping
+          type: integer
+          description: >
+            Amount of flapping hosts
+
+        - name: status.num_hosts_in_downtime
+          type: integer
+          description: >
+            Amount of hosts in downtime
+
+        - name: status.num_hosts_pending
+          type: integer
+          description: >
+            Amount of pending hosts
+
+        - name: status.num_hosts_unreachable
+          type: integer
+          description: >
+            Amount of unreachable hosts
+
+        - name: status.num_hosts_up
+          type: integer
+          description: >
+            Amount of hosts in up state
+
+        - name: status.num_services_acknowledged
+          type: integer
+          description: >
+            Amount of acknowledged services
+
+        - name: status.num_services_critical
+          type: integer
+          description: >
+            Amount of critical services
+
+        - name: status.num_services_flapping
+          type: integer
+          description: >
+            Amount of flapping services
+
+        - name: status.num_services_in_downtime
+          type: integer
+          description: >
+            Amount of services in downtime
+
+        - name: status.num_services_ok
+          type: integer
+          description: >
+            Amount of services in ok state
+
+        - name: status.num_services_pending
+          type: integer
+          description: >
+            Amount of pending services
+
+        - name: status.num_services_unknown
+          type: integer
+          description: >
+            Amount of unknown services
+
+        - name: status.num_services_unreachable
+          type: integer
+          description: >
+            Amount of unreachable services
+
+        - name: status.num_services_warning
+          type: integer
+          description: >
+            Amount of services in warning state
+
+        - name: status.passive_host_checks
+          type: integer
+          description: >
+            Amount of passive host checks
+
+        - name: status.passive_host_checks_15min
+          type: integer
+          description: >
+            Amount of passive host checks in the last 15 minutes
+
+        - name: status.passive_host_checks_1min
+          type: integer
+          description: >
+            Amount of passive host checks in the last minute
+
+        - name: status.passive_host_checks_5min
+          type: integer
+          description: >
+            Amount of passive host checks in the last 5 minutes
+
+        - name: status.passive_service_checks
+          type: integer
+          description: >
+            Amount of passive service checks
+
+        - name: status.passive_service_checks_15min
+          type: integer
+          description: >
+            Amount of passive service checks in the last 15 minutes
+
+        - name: status.passive_service_checks_1min
+          type: integer
+          description: >
+            Amount of passive service checks in the last minute
+
+        - name: status.passive_service_checks_5min
+          type: integer
+          description: >
+            Amount of passive service checks in the last 5 minutes
+
+        - name: status.uptime
+          type: integer
+          description: >
+            Uptime
+
+- key: beat
+  title: Beat
+  description: >
+    Contains common beat fields available in all event types.
+  fields:
+
+    - name: beat.name
+      description: >
+        The name of the Beat sending the log messages. If the Beat name is
+        set in the configuration file, then that value is used. If it is not
+        set, the hostname is used. To set the Beat name, use the `name`
+        option in the configuration file.
+    - name: beat.hostname
+      description: >
+        The hostname as returned by the operating system on which the Beat is
+        running.
+    - name: beat.timezone
+      description: >
+        The timezone as returned by the operating system on which the Beat is
+        running.
+    - name: beat.version
+      description: >
+        The version of the beat that generated this event.
+
+    - name: "@timestamp"
+      type: date
+      required: true
+      format: date
+      example: August 26th 2016, 12:35:53.332
+      description: >
+        The timestamp when the event log record was generated.
+
+    - name: tags
+      description: >
+        Arbitrary tags that can be set per Beat and per transaction
+        type.
+
+    - name: fields
+      type: object
+      object_type: keyword
+      description: >
+        Contains user configurable fields.
+
+    - name: error
+      type: group
+      description: >
+        Error fields containing additional info in case of errors.
+      fields:
+        - name: message
+          type: text
+          description: >
+            Error message.
+        - name: code
+          type: long
+          description: >
+            Error code.
+        - name: type
+          type: keyword
+          description: >
+            Error type.
+- key: cloud
+  title: Cloud provider metadata
+  description: >
+    Metadata from cloud providers added by the add_cloud_metadata processor.
+  fields:
+
+    - name: meta.cloud.provider
+      example: ec2
+      description: >
+        Name of the cloud provider. Possible values are ec2, gce, or digitalocean.
+
+    - name: meta.cloud.instance_id
+      description: >
+        Instance ID of the host machine.
+
+    - name: meta.cloud.instance_name
+      description: >
+        Instance name of the host machine.
+
+    - name: meta.cloud.machine_type
+      example: t2.medium
+      description: >
+        Machine type of the host machine.
+
+    - name: meta.cloud.availability_zone
+      example: us-east-1c
+      description: >
+        Availability zone in which this host is running.
+
+    - name: meta.cloud.project_id
+      example: project-x
+      description: >
+        Name of the project in Google Cloud.
+
+    - name: meta.cloud.region
+      description: >
+        Region in which this host is running.
+- key: docker
+  title: Docker
+  description: >
+    Docker stats collected from Docker.
+  short_config: false
+  anchor: docker-processor
+  fields:
+    - name: docker
+      type: group
+      fields:
+        - name: container.id
+          type: keyword
+          description: >
+            Unique container id.
+        - name: container.image
+          type: keyword
+          description: >
+            Name of the image the container was built on.
+        - name: container.name
+          type: keyword
+          description: >
+            Container name.
+        - name: container.labels
+          type: object
+          object_type: keyword
+          description: >
+            Image labels.
+- key: host
+  title: Host
+  description: >
+    Info collected for the host machine.
+  anchor: host-processor
+  fields:
+    - name: host
+      type: group
+      fields:
+        - name: name
+          type: keyword
+          description: >
+            Hostname.
+        - name: id
+          type: keyword
+          description: >
+            Unique host id.
+        - name: architecture
+          type: keyword
+          description: >
+            Host architecture (e.g. x86_64, arm, ppc, mips).
+        - name: os.platform
+          type: keyword
+          description: >
+            OS platform (e.g. centos, ubuntu, windows).
+        - name: os.version
+          type: keyword
+          description: >
+            OS version.
+        - name: os.family
+          type: keyword
+          description: >
+            OS family (e.g. redhat, debian, freebsd, windows).
+        - name: ip
+          type: ip
+          description: >
+            List of IP-addresses.
+        - name: mac
+          type: keyword
+          description: >
+            List of hardware-addresses, usually MAC-addresses.
+
+- key: kubernetes
+  title: Kubernetes
+  description: >
+    Kubernetes metadata added by the kubernetes processor
+  short_config: false
+  anchor: kubernetes-processor
+  fields:
+    - name: kubernetes
+      type: group
+      fields:
+        - name: pod.name
+          type: keyword
+          description: >
+            Kubernetes pod name
+
+        - name: pod.uid
+          type: keyword
+          description: >
+            Kubernetes Pod UID
+
+        - name: namespace
+          type: keyword
+          description: >
+            Kubernetes namespace
+
+        - name: node.name
+          type: keyword
+          description: >
+            Kubernetes node name
+
+        - name: labels
+          type: object
+          description: >
+            Kubernetes labels map
+
+        - name: annotations
+          type: object
+          description: >
+            Kubernetes annotations map
+
+        - name: container.name
+          type: keyword
+          description: >
+            Kubernetes container name
+
+        - name: container.image
+          type: keyword
+          description: >
+            Kubernetes container image

include/fields.go

@@ -0,0 +1,35 @@
+// Licensed to Elasticsearch B.V. under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Elasticsearch B.V. licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+// Code generated by beats/dev-tools/cmd/asset/asset.go - DO NOT EDIT.
+
+package include
+
+import (
+	"github.com/elastic/beats/libbeat/asset"
+)
+
+func init() {
+	if err := asset.SetFields("icingabeat", "fields.yml", Asset); err != nil {
+		panic(err)
+	}
+}
+
+// Asset returns asset data
+func Asset() string {
+	return "eJy8XE1z3LjRvvtXdO3pfatGU7Edu1I6pKKVnawqa1u19uaQCxcD9MwgIgEaADWa/PoUPvglfgscX1Q1FPk8D4BGdwNo8goe8HwNnHJxIDsk5hWA4SbFZ9cYaqp4brgU1/CBGAIKKfJHZLBXMgNzRLhzD8AbuLm/ewWw55gyff0KAOAKBMnwGgzPUBuS5e4qgDnneA2MGAwXWjx/DRcBvpXPgdwDPqIwICktlEJB8VWb4pxjC/0Bzyep2ATBOUeLbdvBJC0yFKaN67ujhXxQsihb0mztWIt7Wz0ibGbrB3pgqBemCAd7o8lzlNrE8fwitQFzJAaM4ocDKmSO07WxS6hRPXIa2bavHmQJrWmPlCflwuAB1UxSC1H2KD0ifRigSXoH7wVcpjGEA4SkMEep4nrzxmFYIgIZak0OPQYppOF7TokF6G/gi6yzCdszC/Cpa53PLo6R4JOZaFahUenI7tvvkRpkHsvzjTeL0AchTymyA9pZuYK9lN1JxHPwLjs+5VydI1zZRwcwl851RZduURff7eFINOwQBWjnOoseJjdFEoW6SM2WUMMfu726kzJFImbTOkw4EQ0eEKSCnGhtsccF+B9aFirW24WYzIU2RJReT9MjsiINXm/AO7QFySwjgkXMp1uP4AXYPsEnpIVBNsHsb7OOA3v4l8VQOB1RQIVordCPEQq2QIg2RHVdy0pSHPgMMdxYHaboOqBFk//jEzcQgMYpZWHyIsajfnEAVUsn6HJUe6kya7QJI4ZEEN/XUHaU7GxwT4O7OuUMysmymv0FQC4Orfg8ywgrMevZYO2lKrcwJeLH5EMtTmPSyCj37dcNSJGe4ZGknAHfl754Hv+KOTXXQ5lmi/KRKJ2QvUG1JcZglnfHe1EP3LqBDlDggEvLK93QfEUKCT2SXRoZJX8rYXz2G6vqIpYZRL1UzroZ/Qu07HAvFV7ChjzyS4YraLqQFUXrWsGObstovpqedQ1ptiaZ2dx8myT2d0QU/l3w7wUCZyjs+gbDojHgDxOvvUqdJERh1DkxvKe1C9Y5FsRt/ixjjR7iQFyu6WYQ2xUZRrfXoSxp8FFq029Ty7eQLMxM2hQPhJ4T3s3lFnXzrw4G7j7MpI1v6N3SiZMT+kAOkay3Uuz5AQLWTOawT7fC6JabdQsG2IamlBjsLoyWbP4EDCg0Mtid5xGvtOE0zRSdjN56JL9VPMjziErboBBJ5SwoYLnlXyCXu/8gHWnmf6WIbOa/pXCrHBvoAqld6BxQoCK9q2wmT8I6sYvFu5JghHrtiDeDsjS5lze3Nt9ZdNYmEnkS2G3nkj0lZ1oeZpiNFcpvpj5nWuTxPwSU2Y1EwWKjauvgpwQGFGOGu0r6UhO7PYKK2s4eqnBi7uz5E3bj69Lt04qUa3CIIBXsU3zidsEwzL5iYlGHnRnjvVJm8e2I5QNVejGDPb7BH8r+9rOz4blGaFdMMsr51cg1ZrS72rRKdt2Dgvmu5OcznI4ya1v6yIZYzX/BXGdO8w1R5lKz3YH37AtX7JfJtdwO2Yy2h8PbS/q66nx4WsZFLHABf8wYVFO/whqhi04+a7be7LNiulD6OcOyTkQnlAiKabpmIHPRs4Idpl8p8R1tqz/zCUediYuZbi8o8jzpxp90WjwIeAu4k9fvMh6Zp3UVuPOeI0JKtIHX7yDjorA+a5GwFXRxM6LLi1qk6eJ9Nb+ryii4ogkFyMqKlghY0Y7aMgZNaZm6HyCutKdFwn5Er83otJxvffJpIms/bu7voEIaoxNFllApXJFBLrkwkTb8uch2fsVvUX2JTw09pWQlEd+kISmISsp8AUKaC3WHkGZZlzwekrryojfTW2afj6js4qKuvCi3rKf8zOMhsWmqoF2bfJGCAAaj4dmJQkVllkuBwpQXtpz1HJot0nHH0knnOkifo2BcHOIU3HuQKRF7nmIqbVq6zQgXV6mM5P1EuEjlAVCQXW8iFoh9xS/J8zRU421Jnm/9U4k7wU+ORLC0L/delCN+dCW9JVacrn1K8rxvaBYp+ntAAYYGqZsnUarG8stFwn5ppCpRippVlpGaPjeh4lTlqPa91U6LBN0HlDgtEzndIkVf2/nAy3QJydbYZ/ksmd9kWUifx+7s3d99WEqp5EGRbKDaa1kyUBV8hZLQwULDUUWrrMn/FUAGqZnMzvp7GhIFy82ZvHLXtlX2ELku//ClTkRepqQsql3BJq2au7JGd9w2xxR9L1Cdk+8FFphwg1lk2mZVOUhwYGUa7/BfJnAV87GyND1iRsptnUExGXlaNX38RJ6epY6j1KskjJazBBok42LddnIxu51crNROLibb2YzadVbaemMiSsPn0XcvShFF5hIanTReYIiMDTeZLIQ/QG1gup2Z4cy4FsLkKXbhXgmwWLOJB9PNF5KXeLMFcJFUm5wraXDA1tlN7p7WMlZZENUSAtzsXijEcCnlCyU0IOfL6L7lGDsGRR7evxtjD6nqD5iQJdM8OVRxwymJLF2vpZR4C2VcbJIuk3GBqVpiz56tlRj5cAkN8mGJtV7IaSwblUJY814tegS4xSIu6r+WiTkRJVYclqZ9BOgJIwkvpqx4KlfbSHjnpXVAN1/GKgcrY2KWHrD0avyBEieOWfrk/cgenN+Bq57gdfTNPMzrF3MZo4s72BtS+mOFzrS+9U/5loic7swij88JfvcYr8IHTdqfMvm55yMm/vFbKQzhQrv6YCncc+FbHkAeCU9d/OACSJqGT29YcXrb+MDJq2aTLECzGG9A8rdjXehle8oqBB0CuOs6eSi/PKC3cNe4yz3G6ymq0ZT9TVuFdHue4sZeF/6t60eSFq6astDIHCY39qeQpgnmHnEeJTCF+79JR9XSsbH/c5f+sD//qHCka/Gwrm2300rG6Y6rtBENCk2hRFk4hiBztDQ2xp61wQykgNOR02MtvNF3qhA2HveosdbUqMMZUVPeeUk17X2zETGNOifL4MzZDX5V8954AXXbNt2f/lZ9rOanV82J2KilU/i94ArZNRhVlBf9e9St+/CJZLmdejfFodAG3rw3R3jzp9fvN/D6zfXbd9fv3m7fvn0zr3cb1XnVZ1rcBFFIpWLtmv5njTLkoMdZbtSOG0XU2d3re4sS6wqcveeo/EARwdwPo4jQhLY2m2w/PSP23qHVj+GFhzBD3I+kb/9zQGjlqwqNqp5T1kF5smcKUKnqNQJP0/xg0QDJR/tQ6QGpZ7T2Sxjj9l6SAhd7aWc2Jdr5L8ejt6UxDHwIqfyMCkCz05ZUKXppAWfbIaCSddFT2UrkJ9EtSBc6vubRo3szCSGKprJgdYy6tT8hV/KRM7TNNCScBPbAfgr/9R/foq1HtR2r2gURxhJ3Q1JC2jspai3VYBSzt27dU9sS9vnERjoxez83wltb4RbupdbcGq6LSRqIQgu4gQPFDUgFjB+4IamkSMR2UFt1AsMnpk51tuIr6ssABxmhRy6eT90+hunI1Dq/WcYSbmi+/ln1s3mzzZDxIhtn/+Qhqjc/55OHNIen3JyTRsirFBT6Cok2V6/phCNtAIGLiLyOdlx7OVzXYW7E5JxvrEa1khL+c/U03/TCI1bLP6Q8pOhn2jC7wsNkqP3N3TPVvjDRmaQPbv6Emf6h/N0D7v/nEmPrftPUF0q5ae7/Z+esPkrlKrT2/HANe5JqO2hE0KNUJd9VNcsHvsVXyYLe+DDkx0NMcDVIcT4xvCFXAQJnfV69osuiXzRp2oWDK7PTIMAmEruCpwakGJMSf+B7W3FarDGulOww7S7IW7kEjOcTE1ruMl+PZnkqow0f9wsm+4v/1QNyZ5OBhqHaKNdxPbVt2uuTltn4sOB8u1zvja/uaKxk6d5B9Bg5UfTIDVJTqDVeh2/Cwf/h9rCFp7+8T97/eQNEZRvIc7qBjOf6/7tSpN7mKTE2pY9T8uUrlEBBA0VhpN5AsSuEKTZw4oLJ04CIVSoFvnwtF0S9HHuS8TSyxPjLV/AwoZEK2ZGYDTDccSI2sFeIO83GWst7Ts3yeey/cu22Ye7urwhjCrVG3SXICI1rZElzJIqdiMKabAOFLkianuHTzW1TQ+lHHoodKoH+HbHgTf7ZvNZDW/+/SoPbOW0NCk1fMh4W64cmHVBLNCxyQ7lkK4SHRg/kkg1UBFmqItY1NZjuJYPf+2rU7F+dk9hvETaoasQumV2BrdqDYrjgb25wnUfk0SAjeZeJCCHNQLXpC+kakP2cayYsDV7ayl3GaFdI2Xp5Pe7/AgAA///HRCGH"
+}