{
"network":{
"type":"ipv6",
"direction":"inbound-XYZ",
"iana_number":41
},
"newnetwork":{
"type":"ip",
"direction":"ABC-outbound",
"iana_number":6
},
"error":{
"code":"process has exited. inode=0, tcp_state=TIME-WAIT"
},
"user":{
"name":"root",
"full_name":"root",
"id":"0"
},
"source":{
"ip":"10.106.125.152",
"port":22
},
"destination":{
"ip":"127.0.0.1",
"port":2282
},
"service":{
"type":"system"
},
"event":{
"duration":17345372,
"dataset":"system.socket",
"module":"system"
},
"tags":[
"vm_i_raw_event"
],
"ecs":{
"version":"1.6.0"
},
"host":{
"architecture":"x86_64",
"os":{
"name":"Red Hat Enterprise Linux Server",
"family":"redhat",
"platform":"rhel",
"version":"7.9 (Maipo)",
"codename":"Maipo",
"kernel":"3.10.0-1160.6.1.el7.x86_64"
},
"containerized":false,
"name":"vl-vm-ic762",
"id":"d69e0181566b99b60326991cad162e19",
"ip":[
"10.247.152.27",
"fe80::f816:3eff:fe63:615f"
],
"mac":[
"fa:16:3e:63:61:5f"
],
"hostname":"vl-vm-ic762"
},
"@timestamp":"2021-02-10T00:02:42.705Z",
"metricset":{
"period":300000,
"name":"socket"
},
"agent":{
"name":"vl-vm-ic762",
"type":"metricbeat",
"ephemeral_id":"64506ba5-3ea9-4a76-a0d9-7b1d369cc807",
"id":"705840f2-3674-4c2e-9a70-081042d34ee1",
"version":"7.10.0",
"hostname":"vl-vm-ic762"
},
"@version":"1",
"system":{
"socket":{
"remote":{
"ip":"127.0.0.1",
"port":34086
},
"local":{
"ip":"127.0.0.1",
"port":2282
}
}
}
} |
{
"metricType": "$.agent.type",
"instance": "$.agent.name",
"properties.entityName": "$.network[?(@.direction =~ /^.*inbound-.*$/i)].direction",
"properties.entityType": "$.network[?(@.type == 'ipv6')].type",
"processedTimestamp": "$.@timestamp",
"metrics": "$.metricset",
"type": "KafkaCollector-One",
"properties.dataSource": "$.source.ip",
"properties.deviceName": "$.newnetwork[?(@.direction =~ /^.*-outbound.*$/i)].direction",
"timestamp": "$.@timestamp",
"properties.deviceType": "$.newnetwork[?(@.type =~ /^.*ip.*$/i)].type",
"tags": "$.tags"
} |
{
"instance":"vl-vm-ic762",
"metricType":"metricbeat",
"timestamp":1612895562705,
"processedTimestamp":1612895562705,
"type":"KafkaCollector-One",
"metrics":{
"period":300000.0
},
"properties":{
"deviceType":"ip",
"entityName":"inbound-XYZ",
"entityType":"ipv6",
"dataSource":"10.106.125.152",
"deviceName":"ABC-outbound"
},
"tags":{
}
} |
