Swap ECS 1.7 experimental schema with non-experimental to revert wild…

…card changes (elastic#23673) * Swap ECS 1.7 experimental schema with non-experimental to revert wildcard changes * Add back in user.effective.* fields to auditd integrations due to no longer using experimental schema
narph · Jan 26, 2021 · 0f50eb7 · 0f50eb7
1 parent ee485bd
commit 0f50eb7
Show file tree

Hide file tree

Showing 20 changed files with 1,153 additions and 3,839 deletions.
diff --git a/auditbeat/_meta/fields.common.yml b/auditbeat/_meta/fields.common.yml
@@ -66,6 +66,27 @@
         type: keyword
         description: Audit user name.
 
+    - name: effective
+      type: group
+      description: Effective user information.
+      fields:
+      - name: id
+        type: keyword
+        description: Effective user ID.
+      - name: name
+        type: keyword
+        description: Effective user name.
+      - name: group
+        type: group
+        description: Effective group information.
+        fields:
+        - name: id
+          type: keyword
+          description: Effective group ID.
+        - name: name
+          type: keyword
+          description: Effective group name.
+
     - name: filesystem
       type: group
       description: Filesystem user information.