Parsers and Generated Fields
Tag Fields Created by Parser infoblox-nios
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser infoblox-nios
| Vendor Field | CPS Field | Description |
|---|---|---|
| `dns.resolved_ip[]` | Array | __repeatMessage |
| `event.category[]` | Array | Vendor.service_name, event.action |
| `event.type[]` | Array | Vendor.service_name, event.action |
| `host.ip[]` | Array | host.domain |
| `server.domain` | Copied | server.address |
| `server.ip` | Copied | server.address |
| `transaction.id` | Copied | Vendor.dhcp.trans_id |
| `client.domain` | Extracted | message, client.address |
| `client.ip` | Extracted | message, client.address |
| `client.mac` | Extracted | message |
| `client.port` | Extracted | message |
| `dns.answers.type` | Extracted | message |
| `dns.question.class` | Extracted | message |
| `dns.question.name` | Extracted | message |
| `dns.question.response_code` | Extracted | message |
| `dns.question.type` | Extracted | message |
| `event.action` | Extracted | message |
| `host.domain` | Extracted | @rawstring |
| `interface.name` | Extracted | message |
| `log.syslog.priority` | Extracted | @rawstring |
| `log.syslog.timestamp` | Extracted | @rawstring |
| `message` | Extracted | @rawstring |
| `network.name` | Extracted | message |
| `network.transport` | Extracted | message |
| `process.id` | Extracted | @rawstring |
| `server.address` | Extracted | message |
| `server.mac` | Extracted | message |
| `server.port` | Extracted | message |
| `user.name` | Extracted | __userName |
| `@timestamp` | Parsed | log.syslog.timestamp |
| `dns.answers[].class` | Parsed | __repeatMessage |
| `dns.answers[].data` | Parsed | __repeatMessage |
| `dns.answers[].name` | Parsed | __repeatMessage |
| `dns.answers[].ttl` | Parsed | __repeatMessage |
| `dns.answers[].type` | Parsed | __repeatMessage |
| `network.type` | Set | client.address, server.address |
| `ecs.version` | Static | None |
| `event.dataset` | Static | Vendor.service_name |
| `event.kind` | Static | None |
| `event.module` | Static | None |
| `event.outcome` | Static | event.action |
| client.address | client.ip | |
| server.address | server.ip |