Add user.groups

CHANGELOG.md

@@ -14,6 +14,7 @@ All notable changes to this project will be documented in this file based on the
 * Add `host.name` field and clarify usage of `host.hostname`.
 * Add `event.start` and `event.end` date fields.
 * Create new `related` field set with `related.ip`. #206
+* Add `user.groups` field. #204
 
 ### Improvements
 

README.md

@@ -419,6 +419,7 @@ Note also that the `user` fields may be used directly at the top level.
 | <a name="user.name"></a>user.name | Name of the user.<br/>The field is a keyword, and will not be tokenized. | core | keyword |  |
 | <a name="user.email"></a>user.email | User email address. | extended | keyword |  |
 | <a name="user.hash"></a>user.hash | Unique user hash to correlate information for a user in anonymized form.<br/>Useful if `user.id` or `user.name` contain confidential information and cannot be used. | extended | keyword |  |
+| <a name="user.group"></a>user.group | Group the user is a part of. This field can contain a list of groups, if necessary. | extended | keyword |  |
 
 
 

fields.yml

@@ -1271,3 +1271,10 @@
 
             Useful if `user.id` or `user.name` contain confidential information and
             cannot be used.
+
+        - name: group
+          level: extended
+          type: keyword
+          description: >
+            Group the user is a part of. This field can contain a list of groups, if
+            necessary.

schema.csv

@@ -127,6 +127,7 @@ url.query,keyword,extended,
 url.scheme,keyword,extended,https
 url.username,keyword,extended,
 user.email,keyword,extended,
+user.group,keyword,extended,
 user.hash,keyword,extended,
 user.id,keyword,core,
 user.name,keyword,core,

schemas/user.yml

@@ -44,3 +44,10 @@
 
         Useful if `user.id` or `user.name` contain confidential information and
         cannot be used.
+
+    - name: group
+      level: extended
+      type: keyword
+      description: >
+        Group the user is a part of. This field can contain a list of groups, if
+        necessary.

template.json

@@ -618,6 +618,10 @@
               "ignore_above": 1024,
               "type": "keyword"
             },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
             "hash": {
               "ignore_above": 1024,
               "type": "keyword"