Import user.group changes from ECS (elastic#10275)

This change enables us to nest the `group` field set at `user.group`, rather than being limited to only group name. Imports the changes from ECS elastic/ecs#308, which solves elastic/ecs#304.
DStape · Jan 24, 2019 · 2623ef6 · 2623ef6
1 parent 01e6f06
commit 2623ef6
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 3 deletions.
diff --git a/docs/fields.asciidoc b/docs/fields.asciidoc
@@ -3471,12 +3471,29 @@ Useful if `user.id` or `user.name` contain confidential information and cannot b
 
 --
 
-*`user.group`*::
+[float]
+== group fields
+
+The group fields are meant to represent groups that are relevant to the event.
+
+
+
+*`user.group.id`*::
 +
 --
 type: keyword
 
-Group the user is a part of. This field can contain a list of groups, if necessary.
+Unique identifier for the group on the system/platform.
+
+
+--
+
+*`user.group.name`*::
++
+--
+type: keyword
+
+Name of the group.
 
 
 --