Operating System Fields

os.family

OS family (such as redhat, debian, freebsd, windows).

type: keyword

example: debian

extended

os.full

[beta] Use of the match_only_text type in the .text multi-field is currently beta.

Operating system name, including the version or code name.

type: keyword

Multi-fields:

* os.full.text (type: match_only_text)

example: Mac OS Mojave

extended

os.kernel

Operating system kernel version as a raw string.

type: keyword

example: 4.4.0-112-generic

extended

os.name

[beta] Use of the match_only_text type in the .text multi-field is currently beta.

Operating system name, without the version.

type: keyword

Multi-fields:

* os.name.text (type: match_only_text)

example: Mac OS X

extended

os.platform

Operating system platform (such centos, ubuntu, windows).

type: keyword

example: darwin

extended

os.type

Use the os.type field to categorize the operating system into one of the broad commercial families.

One of these following values should be used (lowercase): linux, macos, unix, windows.

If the OS you’re dealing with is not in the list, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.

type: keyword

example: macos

extended

os.version

Operating system version as a raw string.

type: keyword

example: 10.14.1

extended