r00tu53r · May 20, 2022 · May 17, 2022 · May 18, 2022 · May 19, 2022 · May 19, 2022
@@ -22,6 +22,8 @@
   name: log.file.path
 - external: ecs
   name: log.logger
+- external: ecs
+  name: log.level
 - external: ecs
   name: message
 - external: ecs
@@ -66,6 +68,8 @@
   name: source.geo.region_name
 - external: ecs
   name: source.ip
+- external: ecs
+  name: source.address
 - external: ecs
   name: tags
 - external: ecs
@@ -90,3 +94,11 @@
   name: user_agent.os.version
 - external: ecs
   name: user_agent.version
+- external: ecs
+  name: client.user.email
+- external: ecs
+  name: client.user.id
+- external: ecs
+  name: error.code
+- external: ecs
+  name: error.message
@@ -14,6 +14,9 @@
         - name: authority_selector
           type: keyword
           description: "The authority selector specified by the requestor, if any. It is not guaranteed  that the principal was allowed to use this authority."
+        - name: principal_subject
+          type: keyword
+          description: "String representation of identity of requesting party. Populated for both first and third party identities. Only present for APIs that support third-party identities."
     - name: authorization_info
       type: array
       description: |
@@ -25,6 +28,9 @@
         - name: granted
           type: boolean
           description: "Whether or not authorization for resource and permission was granted."
+        - name: resource
+          type: keyword
+          description: "The resource being accessed, as a REST-style string."
         - name: resource_attributes
           type: group
           fields:
@@ -40,6 +46,23 @@
               type: keyword
               description: |
                 The type of the resource.
+    - name: labels
+      type: flattened
+    - name: logentry_operation
+      type: group
+      fields:
+        - name: id
+          type: keyword
+          description: "Optional. An arbitrary operation identifier. Log entries with the same identifier are assumed to be part of the same operation."
+        - name: producer
+          type: keyword
+          description: "Optional. An arbitrary producer identifier. The combination of id and producer must be globally unique."
+        - name: first
+          type: boolean
+          description: "Optional. Set this to True if this is the first log entry in the operation."
+        - name: last
+          type: boolean
+          description: "Optional. Set this to True if this is the last log entry in the operation."
     - name: method_name
       type: keyword
       description: |
@@ -49,22 +72,7 @@
       description: |
         The number of items returned from a List or Query API method, if applicable.
     - name: request
-      type: group
-      fields:
-        - name: proto_name
-          type: keyword
-          description: |
-            Type property of the request.
-        - name: filter
-          type: keyword
-          description: |
-            Filter of the request.
-        - name: name
-          type: keyword
-          description: "Name of the request."
-        - name: resource_name
-          type: keyword
-          description: "Name of the request resource."
+      type: flattened
     - name: request_metadata
       type: group
       fields:
@@ -79,37 +87,7 @@
           description: |
             The user agent of the caller. This information is not authenticated and  should be treated accordingly.
     - name: response
-      type: group
-      fields:
-        - name: proto_name
-          type: keyword
-          description: |
-            Type property of the response.
-        - name: details
-          type: group
-          fields:
-            - name: group
-              type: keyword
-              description: |
-                The name of the group.
-            - name: kind
-              type: keyword
-              description: |
-                The kind of the response details.
-            - name: name
-              type: keyword
-              description: |
-                The name of the response details.
-            - name: uid
-              type: keyword
-              description: |
-                The uid of the response details.
-        - name: status.allowed
-          type: boolean
-        - name: status.reason
-          type: keyword
-        - name: status.value
-          type: keyword
+      type: flattened
     - name: resource_name
       type: keyword
       description: |
@@ -118,7 +96,7 @@
       type: group
       fields:
         - name: current_locations
-          type: keyword
+          type: array
           description: |
             Current locations of the resource.
     - name: service_name

@@ -1,16 +1,23 @@
 {
     "@timestamp": "2019-12-19T00:44:25.051Z",
     "agent": {
-        "ephemeral_id": "0365945c-c25a-4f02-b62c-a94a0b661f02",
-        "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91",
+        "ephemeral_id": "69f3a6a9-a809-46eb-9443-a19d76c6cf1c",
+        "hostname": "docker-fleet-agent",
+        "id": "9dfde2d0-fc3b-434b-9aff-534592ab422b",
         "name": "docker-fleet-agent",
         "type": "filebeat",
-        "version": "8.0.0-beta1"
+        "version": "7.17.0"
+    },
+    "client": {
+        "user": {
+            "email": "xxx@xxx.xxx"
+        }
     },
     "cloud": {
         "project": {
             "id": "elastic-beats"
-        }
+        },
+        "provider": "gcp"
     },
     "data_stream": {
         "dataset": "gcp.audit",
@@ -21,25 +28,31 @@
         "version": "8.2.0"
     },
     "elastic_agent": {
-        "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91",
+        "id": "9dfde2d0-fc3b-434b-9aff-534592ab422b",
         "snapshot": false,
-        "version": "8.0.0-beta1"
+        "version": "7.17.0"
     },
     "event": {
         "action": "beta.compute.instances.aggregatedList",
         "agent_id_status": "verified",
-        "created": "2021-12-31T03:10:44.655Z",
+        "category": [
+            "network",
+            "configuration"
+        ],
+        "created": "2022-05-19T12:27:33.813Z",
         "dataset": "gcp.audit",
         "id": "yonau2dg2zi",
-        "ingested": "2021-12-31T03:10:45Z",
+        "ingested": "2022-05-19T12:27:35Z",
         "kind": "event",
-        "outcome": "success"
+        "outcome": "success",
+        "provider": "data_access",
+        "type": [
+            "access",
+            "allowed"
+        ]
     },
     "gcp": {
         "audit": {
-            "authentication_info": {
-                "principal_email": "xxx@xxx.xxx"
-            },
             "authorization_info": [
                 {
                     "granted": true,
@@ -54,10 +67,9 @@
             "method_name": "beta.compute.instances.aggregatedList",
             "num_response_items": 61,
             "request": {
-                "proto_name": "type.googleapis.com/compute.instances.aggregatedList"
+                "@type": "type.googleapis.com/compute.instances.aggregatedList"
             },
             "request_metadata": {
-                "caller_ip": "192.168.1.1",
                 "caller_supplied_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)"
             },
             "resource_location": {
@@ -67,16 +79,16 @@
             },
             "resource_name": "projects/elastic-beats/global/instances",
             "response": {
+                "@type": "core.k8s.io/v1.Status",
+                "apiVersion": "v1",
                 "details": {
                     "group": "batch",
                     "kind": "jobs",
                     "name": "gsuite-exporter-1589294700",
                     "uid": "2beff34a-945f-11ea-bacf-42010a80007f"
                 },
-                "proto_name": "core.k8s.io/v1.Status",
-                "status": {
-                    "value": "Success"
-                }
+                "kind": "Status",
+                "status": "Success"
             },
             "service_name": "compute.googleapis.com",
             "type": "type.googleapis.com/google.cloud.audit.AuditLog"
@@ -86,6 +98,7 @@
         "type": "gcp-pubsub"
     },
     "log": {
+        "level": "INFO",
         "logger": "projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access"
     },
     "service": {
@@ -98,9 +111,6 @@
         "forwarded",
         "gcp-audit"
     ],
-    "user": {
-        "email": "xxx@xxx.xxx"
-    },
     "user_agent": {
         "device": {
             "name": "Mac"

@@ -1,5 +1,13 @@
 {
     "@timestamp": "2022-01-23T09:16:05.341Z",
+    "agent": {
+        "ephemeral_id": "b233298d-e2ab-47a6-805b-a898e8c85ea4",
+        "hostname": "docker-fleet-agent",
+        "id": "9dfde2d0-fc3b-434b-9aff-534592ab422b",
+        "name": "docker-fleet-agent",
+        "type": "filebeat",
+        "version": "7.17.0"
+    },
     "cloud": {
         "availability_zone": "europe-west2-a",
         "instance": {
@@ -9,8 +17,14 @@
         "project": {
             "id": "project"
         },
+        "provider": "gcp",
         "region": "europe-west2"
     },
+    "data_stream": {
+        "dataset": "gcp.dns",
+        "namespace": "ep",
+        "type": "logs"
+    },
     "dns": {
         "answers": [
             {
@@ -35,11 +49,19 @@
     "ecs": {
         "version": "8.2.0"
     },
+    "elastic_agent": {
+        "id": "9dfde2d0-fc3b-434b-9aff-534592ab422b",
+        "snapshot": false,
+        "version": "7.17.0"
+    },
     "event": {
+        "agent_id_status": "verified",
+        "created": "2022-05-19T12:28:13.203Z",
+        "dataset": "gcp.dns",
         "id": "vwroyze8pg7y",
+        "ingested": "2022-05-19T12:28:14Z",
         "kind": "event",
-        "outcome": "success",
-        "original": "{\"insertId\":\"vwroyze8pg7y\",\"jsonPayload\":{\"authAnswer\":true,\"protocol\":\"UDP\",\"queryName\":\"elastic.co.\",\"queryType\":\"A\",\"rdata\":\"elastic.co.\\t300\\tIN\\ta\\t127.0.0.1\",\"responseCode\":\"NOERROR\",\"serverLatency\":14,\"sourceIP\":\"10.154.0.3\",\"sourceNetwork\":\"default\",\"vmInstanceId\":8340998530665147,\"vmInstanceIdString\":\"8340998530665147\",\"vmInstanceName\":\"694119234537.instance\",\"vmProjectId\":\"project\",\"vmZoneName\":\"europe-west2-a\"},\"logName\":\"projects/project/logs/dns.googleapis.com%2Fdns_queries\",\"receiveTimestamp\":\"2022-01-23T09:16:05.502805637Z\",\"resource\":{\"labels\":{\"location\":\"europe-west2\",\"project_id\":\"project\",\"source_type\":\"gce-vm\",\"target_name\":\"\",\"target_type\":\"external\"},\"type\":\"dns_query\"},\"severity\":\"INFO\",\"timestamp\":\"2022-01-23T09:16:05.341873447Z\"}"
+        "outcome": "success"
     },
     "gcp": {
         "dns": {
@@ -58,6 +80,9 @@
             "vm_zone_name": "europe-west2-a"
         }
     },
+    "input": {
+        "type": "gcp-pubsub"
+    },
     "log": {
         "logger": "projects/project/logs/dns.googleapis.com%2Fdns_queries"
     },
@@ -69,6 +94,7 @@
         "ip": "10.154.0.3"
     },
     "tags": [
-        "preserve_original_event"
+        "forwarded",
+        "gcp-dns"
     ]
 }
@@ -1,17 +1,19 @@
 {
     "@timestamp": "2019-10-30T13:52:42.191Z",
     "agent": {
-        "ephemeral_id": "4fed48b9-0848-4ceb-88b1-30fb7da99604",
-        "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91",
+        "ephemeral_id": "214c2188-c59e-447d-a74a-958be5d3a355",
+        "hostname": "docker-fleet-agent",
+        "id": "9dfde2d0-fc3b-434b-9aff-534592ab422b",
         "name": "docker-fleet-agent",
         "type": "filebeat",
-        "version": "8.0.0-beta1"
+        "version": "7.17.0"
     },
     "cloud": {
         "availability_zone": "us-east1-b",
         "project": {
             "id": "test-beats"
         },
+        "provider": "gcp",
         "region": "us-east1"
     },
     "data_stream": {
@@ -29,18 +31,18 @@
         "version": "8.2.0"
     },
     "elastic_agent": {
-        "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91",
+        "id": "9dfde2d0-fc3b-434b-9aff-534592ab422b",
         "snapshot": false,
-        "version": "8.0.0-beta1"
+        "version": "7.17.0"
     },
     "event": {
         "action": "firewall-rule",
         "agent_id_status": "verified",
         "category": "network",
-        "created": "2021-12-31T03:11:30.136Z",
+        "created": "2022-05-19T12:28:58.807Z",
         "dataset": "gcp.firewall",
         "id": "1f21ciqfpfssuo",
-        "ingested": "2021-12-31T03:11:31Z",
+        "ingested": "2022-05-19T12:28:59Z",
         "kind": "event",
         "type": "connection"
     },