Add field documentation

_meta/beat.yml

@@ -31,12 +31,12 @@ icingabeat:
     # * Notification
     # * AcknowledgementSet
     # * AcknowledgementCleared
-    # * CommentAdded
+    # * CommentAdded (See https://github.com/Icinga/icingabeat/issues/1)
-    # * CommentRemoved
+    # * CommentRemoved (See https://github.com/Icinga/icingabeat/issues/1)
-    # * DowntimeAdded
+    # * DowntimeAdded (See https://github.com/Icinga/icingabeat/issues/1)
-    # * DowntimeRemoved
+    # * DowntimeRemoved (See https://github.com/Icinga/icingabeat/issues/1)
-    # * DowntimeStarted
+    # * DowntimeStarted (See https://github.com/Icinga/icingabeat/issues/1)
-    # * DowntimeTriggered
+    # * DowntimeTriggered (See https://github.com/Icinga/icingabeat/issues/1)
     #
     # At least one type must be set
     types:

_meta/fields.yml

@@ -2,8 +2,167 @@
   title: icingabeat
   description: Data received from the Icinga 2 API
   fields:
-    - name: counter
+    - name: type
-      type: long
+      type: keyword
       required: true
       description: >
-        PLEASE UPDATE DOCUMENTATION
+        Type of the document. Can either be icingabeat.event or icingabet.status
+
+    - name: host
+      type: keyword
+      description: >
+        Host that triggered the event
+
+    - name: service
+      type: keyword
+      description: >
+        Service that triggered the event
+
+    - name: state
+      type: integer
+      description: >
+        State of the check
+
+    - name: state_type
+      type: integer
+      description: >
+        State type of the check
+
+    - name: author
+      type: keyword
+      description: >
+        Author of a message
+
+    - name: notification_type
+      type: keyword
+      description: >
+        Type of notification
+
+    - name: text
+      type: text
+      description: >
+        Text of a message
+
+    - name: users
+      type: text
+      description: >
+        Affected users of a notification
+
+    - name: acknowledgement_type
+      type: integer
+      description: >
+        Type of the acknowledgement
+
+    - name: comment
+      type: text
+      description: >
+        Content of a comment message
+
+    - name: expiry
+      type: integer
+      description: >
+        If an acknowledgement or not
+
+    - name: notify
+      type: keyword
+      description: >
+        If users are notified
+
+    - name: check_result.active
+      type: keyword
+      description: >
+        If check was active or passive
+
+    - name: check_result.check_source
+      type: keyword
+      description: >
+        Icinga instance that scheduled the check
+
+    - name: check_result.command
+      type: text
+      description: >
+        Command that was executed
+
+    - name: check_result.execution_end
+      type: text
+      description: >
+        Time when execution of check ended
+
+    - name: check_result.execution_start
+      type: text
+      description: >
+        Time when execution of check started
+
+    - name: check_result.exit_status
+      type: integer
+      description: >
+        Exit status
+
+    - name: check_result.output
+      type: text
+      description: >
+        Output of check
+
+    - name: check_result.performance_data
+      type: text
+      description: >
+        Performance data in text format
+
+    - name: check_result.schedule_end
+      type: text
+      description: >
+        Time when scheduling of the check ended
+
+    - name: check_result.schedule_start
+      type: text
+      description: >
+        Time when check was scheduled
+    - name: check_result.state
+      type: integer
+      description: >
+        State of the check
+
+    - name: check_result.type
+      type: keyword
+      description: >
+        Type of this event
+
+    - name: check_result.vars_after.attempt
+      type: integer
+      description: >
+        Check attempt after check execution
+
+    - name: check_result.vars_after.reachable
+      type: keyword
+      description: >
+        Reachable state after check execution
+
+    - name: check_result.vars_after.state
+      type: integer
+      description: >
+        State of the check after execution
+
+    - name: check_result.vars_after.state_type
+      type: integer
+      description: >
+        State type after execution
+
+    - name: check_result.vars_before.attempt
+      type: integer
+      description: >
+        Check attempt before check execution
+
+    - name: check_result.vars_before.reachable
+      type: keyword
+      description: >
+        Reachable state before check execution
+
+    - name: check_result.vars_before.state
+      type: integer
+      description: >
+        Check state before check execution
+
+    - name: check_result.vars_before.state_type
+      type: integer
+      description: >
+        State type before check execution

docs/fields.asciidoc

@@ -124,16 +124,272 @@ Region in which this host is running.
 [[exported-fields-icingabeat]]
 == icingabeat Fields
 
-None
+Data received from the Icinga 2 API
 
 
 [float]
-=== counter
+=== type
 
-type: long
+type: keyword
 
 required: True
 
-PLEASE UPDATE DOCUMENTATION
+Type of the document. Can either be icingabeat.event or icingabet.status
+
+
+[float]
+=== host
+
+type: keyword
+
+Host that triggered the event
+
+
+[float]
+=== service
+
+type: keyword
+
+Service that triggered the event
+
+
+[float]
+=== state
+
+type: integer
+
+State of the check
+
+
+[float]
+=== state_type
+
+type: integer
+
+State type of the check
+
+
+[float]
+=== author
+
+type: keyword
+
+Author of a message
+
+
+[float]
+=== notification_type
+
+type: keyword
+
+Type of notification
+
+
+[float]
+=== text
+
+type: text
+
+Text of a message
+
+
+[float]
+=== users
+
+type: text
+
+Affected users of a notification
+
+
+[float]
+=== acknowledgement_type
+
+type: integer
+
+Type of the acknowledgement
+
+
+[float]
+=== comment
+
+type: text
+
+Content of a comment message
+
+
+[float]
+=== expiry
+
+type: integer
+
+If an acknowledgement or not
+
+
+[float]
+=== notify
+
+type: keyword
+
+If users are notified
+
+
+[float]
+=== check_result.active
+
+type: keyword
+
+If check was active or passive
+
+
+[float]
+=== check_result.check_source
+
+type: keyword
+
+Icinga instance that scheduled the check
+
+
+[float]
+=== check_result.command
+
+type: text
+
+Command that was executed
+
+
+[float]
+=== check_result.execution_end
+
+type: text
+
+Time when execution of check ended
+
+
+[float]
+=== check_result.execution_start
+
+type: text
+
+Time when execution of check started
+
+
+[float]
+=== check_result.exit_status
+
+type: integer
+
+Exit status
+
+
+[float]
+=== check_result.output
+
+type: text
+
+Output of check
+
+
+[float]
+=== check_result.performance_data
+
+type: text
+
+Performance data in text format
+
+
+[float]
+=== check_result.schedule_end
+
+type: text
+
+Time when scheduling of the check ended
+
+
+[float]
+=== check_result.schedule_start
+
+type: text
+
+Time when check was scheduled
+
+
+[float]
+=== check_result.state
+
+type: integer
+
+State of the check
+
+
+[float]
+=== check_result.type
+
+type: keyword
+
+Type of this event
+
+
+[float]
+=== check_result.vars_after.attempt
+
+type: integer
+
+Check attempt after check execution
+
+
+[float]
+=== check_result.vars_after.reachable
+
+type: keyword
+
+Reachable state after check execution
+
+
+[float]
+=== check_result.vars_after.state
+
+type: integer
+
+State of the check after execution
+
+
+[float]
+=== check_result.vars_after.state_type
+
+type: integer
+
+State type after execution
+
+
+[float]
+=== check_result.vars_before.attempt
+
+type: integer
+
+Check attempt before check execution
+
+
+[float]
+=== check_result.vars_before.reachable
+
+type: keyword
+
+Reachable state before check execution
+
+
+[float]
+=== check_result.vars_before.state
+
+type: integer
+
+Check state before check execution
+
+
+[float]
+=== check_result.vars_before.state_type
+
+type: integer
+
+State type before check execution
 
 

icingabeat.full.yml

@@ -31,19 +31,19 @@ icingabeat:
     # * Notification
     # * AcknowledgementSet
     # * AcknowledgementCleared
-    # * CommentAdded
+    # * CommentAdded (See https://github.com/Icinga/icingabeat/issues/1)
-    # * CommentRemoved
+    # * CommentRemoved (See https://github.com/Icinga/icingabeat/issues/1)
-    # * DowntimeAdded
+    # * DowntimeAdded (See https://github.com/Icinga/icingabeat/issues/1)
-    # * DowntimeRemoved
+    # * DowntimeRemoved (See https://github.com/Icinga/icingabeat/issues/1)
-    # * DowntimeStarted
+    # * DowntimeStarted (See https://github.com/Icinga/icingabeat/issues/1)
-    # * DowntimeTriggered
+    # * DowntimeTriggered (See https://github.com/Icinga/icingabeat/issues/1)
     #
     # At least one type must be set
     types:
       - CheckResult
       - StateChange
 
-    # Event streams can be filtered by attributes using the prefix event.
+    # Event streams can be filtered by attributes using the prefix 'event.'
     #
     # Example for the CheckResult type with the exit_code set to 2:
     # filter: "event.check_result.exit_status==2"

icingabeat.template-es2x.json

@@ -25,6 +25,14 @@
         "@timestamp": {
           "type": "date"
         },
+        "acknowledgement_type": {
+          "type": "long"
+        },
+        "author": {
+          "ignore_above": 1024,
+          "index": "not_analyzed",
+          "type": "string"
+        },
         "beat": {
           "properties": {
             "hostname": {
@@ -44,9 +52,131 @@
             }
           }
         },
-        "counter": {
+        "check_result": {
+          "properties": {
+            "active": {
+              "ignore_above": 1024,
+              "index": "not_analyzed",
+              "type": "string"
+            },
+            "check_source": {
+              "ignore_above": 1024,
+              "index": "not_analyzed",
+              "type": "string"
+            },
+            "command": {
+              "index": "analyzed",
+              "norms": {
+                "enabled": false
+              },
+              "type": "string"
+            },
+            "execution_end": {
+              "index": "analyzed",
+              "norms": {
+                "enabled": false
+              },
+              "type": "string"
+            },
+            "execution_start": {
+              "index": "analyzed",
+              "norms": {
+                "enabled": false
+              },
+              "type": "string"
+            },
+            "exit_status": {
+              "type": "long"
+            },
+            "output": {
+              "index": "analyzed",
+              "norms": {
+                "enabled": false
+              },
+              "type": "string"
+            },
+            "performance_data": {
+              "index": "analyzed",
+              "norms": {
+                "enabled": false
+              },
+              "type": "string"
+            },
+            "schedule_end": {
+              "index": "analyzed",
+              "norms": {
+                "enabled": false
+              },
+              "type": "string"
+            },
+            "schedule_start": {
+              "index": "analyzed",
+              "norms": {
+                "enabled": false
+              },
+              "type": "string"
+            },
+            "state": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "index": "not_analyzed",
+              "type": "string"
+            },
+            "vars_after": {
+              "properties": {
+                "attempt": {
+                  "type": "long"
+                },
+                "reachable": {
+                  "ignore_above": 1024,
+                  "index": "not_analyzed",
+                  "type": "string"
+                },
+                "state": {
+                  "type": "long"
+                },
+                "state_type": {
+                  "type": "long"
+                }
+              }
+            },
+            "vars_before": {
+              "properties": {
+                "attempt": {
+                  "type": "long"
+                },
+                "reachable": {
+                  "ignore_above": 1024,
+                  "index": "not_analyzed",
+                  "type": "string"
+                },
+                "state": {
+                  "type": "long"
+                },
+                "state_type": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "comment": {
+          "index": "analyzed",
+          "norms": {
+            "enabled": false
+          },
+          "type": "string"
+        },
+        "expiry": {
           "type": "long"
         },
+        "host": {
+          "ignore_above": 1024,
+          "index": "not_analyzed",
+          "type": "string"
+        },
         "meta": {
           "properties": {
             "cloud": {
@@ -85,10 +215,50 @@
             }
           }
         },
+        "notification_type": {
+          "ignore_above": 1024,
+          "index": "not_analyzed",
+          "type": "string"
+        },
+        "notify": {
+          "ignore_above": 1024,
+          "index": "not_analyzed",
+          "type": "string"
+        },
+        "service": {
+          "ignore_above": 1024,
+          "index": "not_analyzed",
+          "type": "string"
+        },
+        "state": {
+          "type": "long"
+        },
+        "state_type": {
+          "type": "long"
+        },
         "tags": {
           "ignore_above": 1024,
           "index": "not_analyzed",
           "type": "string"
+        },
+        "text": {
+          "index": "analyzed",
+          "norms": {
+            "enabled": false
+          },
+          "type": "string"
+        },
+        "type": {
+          "ignore_above": 1024,
+          "index": "not_analyzed",
+          "type": "string"
+        },
+        "users": {
+          "index": "analyzed",
+          "norms": {
+            "enabled": false
+          },
+          "type": "string"
         }
       }
     }

icingabeat.template.json

@@ -22,6 +22,13 @@
         "@timestamp": {
           "type": "date"
         },
+        "acknowledgement_type": {
+          "type": "long"
+        },
+        "author": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
         "beat": {
           "properties": {
             "hostname": {
@@ -38,9 +45,101 @@
             }
           }
         },
-        "counter": {
+        "check_result": {
+          "properties": {
+            "active": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "check_source": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "command": {
+              "norms": false,
+              "type": "text"
+            },
+            "execution_end": {
+              "norms": false,
+              "type": "text"
+            },
+            "execution_start": {
+              "norms": false,
+              "type": "text"
+            },
+            "exit_status": {
+              "type": "long"
+            },
+            "output": {
+              "norms": false,
+              "type": "text"
+            },
+            "performance_data": {
+              "norms": false,
+              "type": "text"
+            },
+            "schedule_end": {
+              "norms": false,
+              "type": "text"
+            },
+            "schedule_start": {
+              "norms": false,
+              "type": "text"
+            },
+            "state": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vars_after": {
+              "properties": {
+                "attempt": {
+                  "type": "long"
+                },
+                "reachable": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "state": {
+                  "type": "long"
+                },
+                "state_type": {
+                  "type": "long"
+                }
+              }
+            },
+            "vars_before": {
+              "properties": {
+                "attempt": {
+                  "type": "long"
+                },
+                "reachable": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "state": {
+                  "type": "long"
+                },
+                "state_type": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "comment": {
+          "norms": false,
+          "type": "text"
+        },
+        "expiry": {
           "type": "long"
         },
+        "host": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
         "meta": {
           "properties": {
             "cloud": {
@@ -73,9 +172,39 @@
             }
           }
         },
+        "notification_type": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "notify": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "service": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "state": {
+          "type": "long"
+        },
+        "state_type": {
+          "type": "long"
+        },
         "tags": {
           "ignore_above": 1024,
           "type": "keyword"
+        },
+        "text": {
+          "norms": false,
+          "type": "text"
+        },
+        "type": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "users": {
+          "norms": false,
+          "type": "text"
         }
       }
     }

icingabeat.yml

@@ -31,19 +31,19 @@ icingabeat:
     # * Notification
     # * AcknowledgementSet
     # * AcknowledgementCleared
-    # * CommentAdded
+    # * CommentAdded (See https://github.com/Icinga/icingabeat/issues/1)
-    # * CommentRemoved
+    # * CommentRemoved (See https://github.com/Icinga/icingabeat/issues/1)
-    # * DowntimeAdded
+    # * DowntimeAdded (See https://github.com/Icinga/icingabeat/issues/1)
-    # * DowntimeRemoved
+    # * DowntimeRemoved (See https://github.com/Icinga/icingabeat/issues/1)
-    # * DowntimeStarted
+    # * DowntimeStarted (See https://github.com/Icinga/icingabeat/issues/1)
-    # * DowntimeTriggered
+    # * DowntimeTriggered (See https://github.com/Icinga/icingabeat/issues/1)
     #
     # At least one type must be set
     types:
       - CheckResult
       - StateChange
 
-    # Event streams can be filtered by attributes using the prefix event.
+    # Event streams can be filtered by attributes using the prefix 'event.'
     #
     # Example for the CheckResult type with the exit_code set to 2:
     # filter: "event.check_result.exit_status==2"