docker.yml

namespace:
  name: docker
  type: group
  description: >
    Namespace for docker container-specific metadata
  fields:
  - name: container_name
    type: text
    doc_values: false
    norms: true
    description: >
      The name of the container - not used for Kubernetes containers.
    fields:
      - name: raw
        ignore_above: 256
        type: keyword

  - name: container_id
    type: keyword
    description: >
      Docker container id

  - name: container_id_short
    type: keyword
    description: >
      Short container id, assigned by the container engine

  - name: sauid
    type: keyword
    description: >
      Sent login user id

  - name: container_image
    type: keyword
    description: >
      Name of the image

  - name: pid
    type: keyword
    description: >
      The process id

  - name: user
    type: keyword
    description: >
      User under which the container process runs

  - name: command
    type: keyword
    description: >
      Name of the command

  - name: reason
    type: keyword
    description: >
      Action that triggered this event

  - name: operation
    type: keyword
    description: >
      Operation carried out

  - name: result
    type: keyword
    description: >
      Result of the action