Swap ECS 1.7 experimental schema with non-experimental to revert wild…

…card changes (#23673) (#23700) * Swap ECS 1.7 experimental schema with non-experimental to revert wildcard changes * Add back in user.effective.* fields to auditd integrations due to no longer using experimental schema (cherry picked from commit 0f50eb7)
elastic · Jan 26, 2021 · d1aa3ff · d1aa3ff
1 parent e8ade83
commit d1aa3ff
Show file tree

Hide file tree

Showing 20 changed files with 1,153 additions and 3,839 deletions.
diff --git a/auditbeat/_meta/fields.common.yml b/auditbeat/_meta/fields.common.yml
@@ -66,6 +66,27 @@
         type: keyword
         description: Audit user name.
 
+    - name: effective
+      type: group
+      description: Effective user information.
+      fields:
+      - name: id
+        type: keyword
+        description: Effective user ID.
+      - name: name
+        type: keyword
+        description: Effective user name.
+      - name: group
+        type: group
+        description: Effective group information.
+        fields:
+        - name: id
+          type: keyword
+          description: Effective group ID.
+        - name: name
+          type: keyword
+          description: Effective group name.
+
     - name: filesystem
       type: group
       description: Filesystem user information.