
////
This file is generated! See _meta/fields.yml and scripts/generate_field_docs.py
////

[[exported-fields]]
= Exported Fields

[partintro]

--
This document describes the fields that are exported by Icingabeat. They are
grouped in the following categories:

* <<exported-fields-beat>>
* <<exported-fields-cloud>>
* <<exported-fields-icingabeat>>

--
[[exported-fields-beat]]
== Beat Fields

Contains common beat fields available in all event types.



[float]
=== beat.name

The name of the Beat sending the log messages. If the Beat name is set in the configuration file, then that value is used. If it is not set, the hostname is used. To set the Beat name, use the `name` option in the configuration file.


[float]
=== beat.hostname

The hostname as returned by the operating system on which the Beat is running.


[float]
=== beat.version

The version of the beat that generated this event.


[float]
=== @timestamp

type: date

example: August 26th 2016, 12:35:53.332

format: date

required: True

The timestamp when the event log record was generated.


[float]
=== tags

Arbitrary tags that can be set per Beat and per transaction type.


[float]
=== fields

type: dict

Contains user configurable fields.


[[exported-fields-cloud]]
== Cloud Provider Metadata Fields

Metadata from cloud providers added by the add_cloud_metadata processor.



[float]
=== meta.cloud.provider

example: ec2

Name of the cloud provider. Possible values are ec2, gce, or digitalocean.


[float]
=== meta.cloud.instance_id

Instance ID of the host machine.


[float]
=== meta.cloud.machine_type

example: t2.medium

Machine type of the host machine.


[float]
=== meta.cloud.availability_zone

example: us-east-1c

Availability zone in which this host is running.


[float]
=== meta.cloud.project_id

example: project-x

Name of the project in Google Cloud.


[float]
=== meta.cloud.region

Region in which this host is running.


[[exported-fields-icingabeat]]
== icingabeat Fields

Data received from the Icinga 2 API


[float]
=== type

type: keyword

required: True

Type of the document. Can either be icingabeat.event or icingabet.status


[float]
=== host

type: keyword

Host that triggered the event


[float]
=== service

type: keyword

Service that triggered the event


[float]
=== state

type: integer

State of the check


[float]
=== state_type

type: integer

State type of the check


[float]
=== author

type: keyword

Author of a message


[float]
=== notification_type

type: keyword

Type of notification


[float]
=== text

type: text

Text of a message


[float]
=== users

type: text

Affected users of a notification


[float]
=== acknowledgement_type

type: integer

Type of the acknowledgement


[float]
=== comment

type: text

Content of a comment message


[float]
=== expiry

type: integer

If an acknowledgement or not


[float]
=== notify

type: keyword

If users are notified


[float]
=== check_result.active

type: keyword

If check was active or passive


[float]
=== check_result.check_source

type: keyword

Icinga instance that scheduled the check


[float]
=== check_result.command

type: text

Command that was executed


[float]
=== check_result.execution_end

type: text

Time when execution of check ended


[float]
=== check_result.execution_start

type: text

Time when execution of check started


[float]
=== check_result.exit_status

type: integer

Exit status


[float]
=== check_result.output

type: text

Output of check


[float]
=== check_result.performance_data

type: text

Performance data in text format


[float]
=== check_result.schedule_end

type: text

Time when scheduling of the check ended


[float]
=== check_result.schedule_start

type: text

Time when check was scheduled


[float]
=== check_result.state

type: integer

State of the check


[float]
=== check_result.type

type: keyword

Type of this event


[float]
=== check_result.vars_after.attempt

type: integer

Check attempt after check execution


[float]
=== check_result.vars_after.reachable

type: keyword

Reachable state after check execution


[float]
=== check_result.vars_after.state

type: integer

State of the check after execution


[float]
=== check_result.vars_after.state_type

type: integer

State type after execution


[float]
=== check_result.vars_before.attempt

type: integer

Check attempt before check execution


[float]
=== check_result.vars_before.reachable

type: keyword

Reachable state before check execution


[float]
=== check_result.vars_before.state

type: integer

Check state before check execution


[float]
=== check_result.vars_before.state_type

type: integer

State type before check execution


