search

elastic / ecs

Elastic Common Schema
https://www.elastic.co/what-is/ecs
Apache License 2.0
1.01k stars 418 forks source link

host.infrastructure #539

Open willemdh opened 5 years ago

willemdh commented 5 years ago

Hello,

We are in need of a field which contains the infrastructure the host is running on. This will enable us to visualise information specifically for hosts running for example on VMware. Or visualise data only for our physical servers. I'm just not sure how this field should be named or if there already is a plan to add this.

For now I'll add it on installation like this in the beat.yml's with a Powershell script:

fields_under_root: true fields.host.infrastructure: "VMware"

But it would be nice to see this field (or a similar field) officially integrated into ECS.

Grtz

Willem

webmat commented 5 years ago

Yes, I do feel there's a need for a better way to represent what kind of infrastructure a host is running on. Whether it's bare metal or a VM and so on. I feel like this also relates to containers as well.

In your current usage, you only add host.infrastructure:VMWare? Do you see the need for other kinds of details?

And do you run agents both on the physical machine's OS and from within the VMs?

willemdh commented 5 years ago

@webmat Well, I think there are multiple host infrastructure related fields which could be interesting.

host.virtualised: true|false
host.infrastructure: vmware|hyperv|citrix|physical
host.hardware.type: desktop|laptop|tower|rack-mount|blade
host.hardware.branch: hp|dell|fujitsu
host.hardware.model: PowerEdge R740xd2 Server|PRIMERGY RX4770 M5

But to be honest we might get too far with this. For now I really need a field which defines if a host is running on our VMware environment to be able to visualise metrics only for those hosts. So maybe host.infrastructure could be added in a first step?