From 83b3541a4db6358bade73bad36de07117e2db5e4 Mon Sep 17 00:00:00 2001
From: Mathieu Martin <mathieu.martin@elastic.co>
Date: Mon, 3 Dec 2018 09:14:06 -0500
Subject: [PATCH] Singular `user.group`.

---
 README.md        | 2 +-
 fields.yml       | 5 +++--
 schema.csv       | 2 +-
 schemas/user.yml | 5 +++--
 template.json    | 2 +-
 5 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index 584fbd6278..3d0c46bebe 100644
--- a/README.md
+++ b/README.md
@@ -419,7 +419,7 @@ Note also that the `user` fields may be used directly at the top level.
 | <a name="user.name"></a>user.name | Name of the user.<br/>The field is a keyword, and will not be tokenized. | core | keyword |  |
 | <a name="user.email"></a>user.email | User email address. | extended | keyword |  |
 | <a name="user.hash"></a>user.hash | Unique user hash to correlate information for a user in anonymized form.<br/>Useful if `user.id` or `user.name` contain confidential information and cannot be used. | extended | keyword |  |
-| <a name="user.groups"></a>user.groups | Groups the user is a part of. | extended | keyword |  |
+| <a name="user.group"></a>user.group | Group the user is a part of. This field can contain a list of groups, if necessary. | extended | keyword |  |
 
 
 
diff --git a/fields.yml b/fields.yml
index bb4e4cbbed..84c395ee6d 100644
--- a/fields.yml
+++ b/fields.yml
@@ -1272,8 +1272,9 @@
             Useful if `user.id` or `user.name` contain confidential information and
             cannot be used.
     
-        - name: groups
+        - name: group
           level: extended
           type: keyword
           description: >
-            Groups the user is a part of.
+            Group the user is a part of. This field can contain a list of groups, if
+            necessary.
diff --git a/schema.csv b/schema.csv
index e14090b80f..38fa454b3b 100644
--- a/schema.csv
+++ b/schema.csv
@@ -127,7 +127,7 @@ url.query,keyword,extended,
 url.scheme,keyword,extended,https
 url.username,keyword,extended,
 user.email,keyword,extended,
-user.groups,keyword,extended,
+user.group,keyword,extended,
 user.hash,keyword,extended,
 user.id,keyword,core,
 user.name,keyword,core,
diff --git a/schemas/user.yml b/schemas/user.yml
index f7b7abcad9..4e50d21828 100644
--- a/schemas/user.yml
+++ b/schemas/user.yml
@@ -45,8 +45,9 @@
         Useful if `user.id` or `user.name` contain confidential information and
         cannot be used.
 
-    - name: groups
+    - name: group
       level: extended
       type: keyword
       description: >
-        Groups the user is a part of.
+        Group the user is a part of. This field can contain a list of groups, if
+        necessary.
diff --git a/template.json b/template.json
index fbed72a7c6..0220be2138 100644
--- a/template.json
+++ b/template.json
@@ -618,7 +618,7 @@
               "ignore_above": 1024,
               "type": "keyword"
             },
-            "groups": {
+            "group": {
               "ignore_above": 1024,
               "type": "keyword"
             },