Usage
editUsage
editCreating an ECS event
editThe recommended way to create instances of EcsDocument
is through:
var doc = EcsDocument.CreateNewWithDefaults<EcsDocument>();
This will automatically assign most common ECS fields that can be inferred from the running process.
However there is no requirement to do so, simply creating a new EcsDocument
instance directly
is completely valid and supported.
var ecsDocument = new EcsDocument { Timestamp = DateTimeOffset.Parse("2019-10-23T19:44:38.485Z"), Dns = new Dns { Id = "23666", OpCode = "QUERY", Type = "answer", QuestionName = "www.example.com", QuestionType = "A", QuestionClass = "IN", QuestionRegisteredDomain = "example.com", HeaderFlags = new[] { "RD", "RA" }, ResponseCode = "NOERROR", ResolvedIp = new[] { "10.0.190.47", "10.0.190.117" }, Answers = new[] { new DnsAnswers { Data = "10.0.190.47", Name = "www.example.com", Type = "A", Class = "IN", Ttl = 59 }, new DnsAnswers { Data = "10.0.190.117", Name = "www.example.com", Type = "A", Class = "IN", Ttl = 59 } } }, Network = new Network { Type = "ipv4", Transport = "udp", Protocol = "dns", Direction = "outbound", CommunityId = "1:19beef+RWVW9+BEEF/Q45VFU+2Y=", Bytes = 126 }, Source = new Source { Ip = "192.168.86.26", Port = 5785, Bytes = 31 }, Destination = new Destination { Ip = "8.8.4.4", Port = 53, Bytes = 95 }, Client = new Client { Ip = "192.168.86.26", Port = 5785, Bytes = 31 }, Server = new Server { Ip = "8.8.4.4", Port = 53, Bytes = 95 }, Event = new Event { Duration = 122433000, Start = DateTimeOffset.Parse("2019-10-23T19:44:38.485Z"), End = DateTimeOffset.Parse("2019-10-23T19:44:38.607Z"), Kind = "event", Category = new[] { "network_traffic" } }, Ecs = new Ecs { Version = "1.2.0" }, Metadata = new Dictionary<string, object> { { "client", "ecs-dotnet" } } };
Dynamically assign ECS fields
editAdditionally, ECS fields can be dynamically assigned through
ecsDocument.AssignProperty("orchestrator.cluster.id", "id");
This will assign ecsDocument.Orchestrator.ClusterId
to "id"
and automatically create a new Orchestrator
instance if needed.
Any string
or boolean
value that is not a known ecs
field will be assigned to labels.*
and everything else to metatadata.*