Discover: Rollup index pattern doesn't work with source fetching

[flash1293]

Kibana version: 7.12

Describe the bug: When trying to view a rollup index pattern in Discover, the request fails if the fields API is not enabled (_source fetching)

Steps to reproduce:

1. Configure rollup job
2. Create rollup index pattern for it
3. Turn on "fetch fields from source" flag in settings
4. Go to Discover
5. Request fails

Expected behavior: Request works and shows the technical rollup documents

Screenshots (if relevant):

[elasticmachine]

Pinging @elastic/kibana-app (Team:KibanaApp)

[kertal]

Had the same error using 2 beats provided indices, source fetching, no rollupdata UPDATE: there was one rollup index involved, so this was the reason for this error

[kertal]

This was the Request:

Click to expand, it's very, very long

``` { "size": 500, "sort": [ { "_doc": { "order": "desc", "unmapped_type": "boolean" } } ], "version": true, "aggs": { "2": { "date_histogram": { "field": "@timestamp", "fixed_interval": "30s", "time_zone": "Europe/Vienna", "min_doc_count": 1 } } }, "fields": [ { "field": "@timestamp", "format": "date_time" }, { "field": "ceph.monitor_health.last_updated", "format": "date_time" }, { "field": "docker.container.created", "format": "date_time" }, { "field": "docker.healthcheck.event.end_date", "format": "date_time" }, { "field": "docker.healthcheck.event.start_date", "format": "date_time" }, { "field": "docker.image.created", "format": "date_time" }, { "field": "event.created", "format": "date_time" }, { "field": "event.end", "format": "date_time" }, { "field": "event.ingested", "format": "date_time" }, { "field": "event.start", "format": "date_time" }, { "field": "file.accessed", "format": "date_time" }, { "field": "file.created", "format": "date_time" }, { "field": "file.ctime", "format": "date_time" }, { "field": "file.mtime", "format": "date_time" }, { "field": "file.x509.not_after", "format": "date_time" }, { "field": "file.x509.not_before", "format": "date_time" }, { "field": "kubernetes.container.start_time", "format": "date_time" }, { "field": "kubernetes.event.metadata.timestamp.created", "format": "date_time" }, { "field": "kubernetes.event.timestamp.first_occurrence", "format": "date_time" }, { "field": "kubernetes.event.timestamp.last_occurrence", "format": "date_time" }, { "field": "kubernetes.node.start_time", "format": "date_time" }, { "field": "kubernetes.pod.start_time", "format": "date_time" }, { "field": "kubernetes.service.created", "format": "date_time" }, { "field": "kubernetes.storageclass.created", "format": "date_time" }, { "field": "kubernetes.system.start_time", "format": "date_time" }, { "field": "mongodb.replstatus.server_date", "format": "date_time" }, { "field": "mongodb.status.background_flushing.last_finished", "format": "date_time" }, { "field": "mongodb.status.local_time", "format": "date_time" }, { "field": "mysql.performance.events_statements.last.seen", "format": "date_time" }, { "field": "nats.server.time", "format": "date_time" }, { "field": "package.installed", "format": "date_time" }, { "field": "php_fpm.pool.start_time", "format": "date_time" }, { "field": "php_fpm.process.start_time", "format": "date_time" }, { "field": "postgresql.activity.backend_start", "format": "date_time" }, { "field": "postgresql.activity.query_start", "format": "date_time" }, { "field": "postgresql.activity.state_change", "format": "date_time" }, { "field": "postgresql.activity.transaction_start", "format": "date_time" }, { "field": "postgresql.bgwriter.stats_reset", "format": "date_time" }, { "field": "postgresql.database.stats_reset", "format": "date_time" }, { "field": "process.cpu.start_time", "format": "date_time" }, { "field": "process.parent.start", "format": "date_time" }, { "field": "process.start", "format": "date_time" }, { "field": "system.process.cpu.start_time", "format": "date_time" }, { "field": "system.service.state_since", "format": "date_time" }, { "field": "tls.client.not_after", "format": "date_time" }, { "field": "tls.client.not_before", "format": "date_time" }, { "field": "tls.client.x509.not_after", "format": "date_time" }, { "field": "tls.client.x509.not_before", "format": "date_time" }, { "field": "tls.client_certificate.not_after", "format": "date_time" }, { "field": "tls.client_certificate.not_before", "format": "date_time" }, { "field": "tls.detailed.client_certificate.not_after", "format": "date_time" }, { "field": "tls.detailed.client_certificate.not_before", "format": "date_time" }, { "field": "tls.detailed.server_certificate.not_after", "format": "date_time" }, { "field": "tls.detailed.server_certificate.not_before", "format": "date_time" }, { "field": "tls.server.not_after", "format": "date_time" }, { "field": "tls.server.not_before", "format": "date_time" }, { "field": "tls.server.x509.not_after", "format": "date_time" }, { "field": "tls.server.x509.not_before", "format": "date_time" }, { "field": "tls.server_certificate.not_after", "format": "date_time" }, { "field": "tls.server_certificate.not_before", "format": "date_time" }, { "field": "x509.not_after", "format": "date_time" }, { "field": "x509.not_before", "format": "date_time" }, { "field": "zookeeper.server.version_date", "format": "date_time" } ], "script_fields": {}, "stored_fields": [ "@timestamp", "_id", "_index", "_score", "_source", "_type", "agent.build.original", "agent.ephemeral_id", "agent.hostname", "agent.id", "agent.name", "agent.type", "agent.version", "amqp.app-id", "amqp.auto-delete", "amqp.class-id", "amqp.consumer-count", "amqp.consumer-tag", "amqp.content-encoding", "amqp.content-type", "amqp.correlation-id", "amqp.delivery-mode", "amqp.delivery-tag", "amqp.durable", "amqp.exchange", "amqp.exchange-type", "amqp.exclusive", "amqp.expiration", "amqp.if-empty", "amqp.if-unused", "amqp.immediate", "amqp.mandatory", "amqp.message-count", "amqp.message-id", "amqp.method-id", "amqp.multiple", "amqp.no-ack", "amqp.no-local", "amqp.no-wait", "amqp.passive", "amqp.priority", "amqp.queue", "amqp.redelivered", "amqp.reply-code", "amqp.reply-text", "amqp.reply-to", "amqp.routing-key", "amqp.timestamp", "amqp.type", "amqp.user-id", "apache.status.bytes_per_request", "apache.status.bytes_per_sec", "apache.status.connections.async.closing", "apache.status.connections.async.keep_alive", "apache.status.connections.async.writing", "apache.status.connections.total", "apache.status.cpu.children_system", "apache.status.cpu.children_user", "apache.status.cpu.load", "apache.status.cpu.system", "apache.status.cpu.user", "apache.status.hostname", "apache.status.load.1", "apache.status.load.15", "apache.status.load.5", "apache.status.requests_per_sec", "apache.status.scoreboard.closing_connection", "apache.status.scoreboard.dns_lookup", "apache.status.scoreboard.gracefully_finishing", "apache.status.scoreboard.idle_cleanup", "apache.status.scoreboard.keepalive", "apache.status.scoreboard.logging", "apache.status.scoreboard.open_slot", "apache.status.scoreboard.reading_request", "apache.status.scoreboard.sending_reply", "apache.status.scoreboard.starting_up", "apache.status.scoreboard.total", "apache.status.scoreboard.waiting_for_connection", "apache.status.total_accesses", "apache.status.total_kbytes", "apache.status.uptime.server_uptime", "apache.status.uptime.uptime", "apache.status.workers.busy", "apache.status.workers.idle", "as.number", "as.organization.name", "as.organization.name.text", "beat.id", "beat.state.management.enabled", "beat.state.module.count", "beat.state.output.name", "beat.state.queue.name", "beat.stats.libbeat.output.events.acked", "beat.stats.libbeat.output.events.active", "beat.stats.libbeat.output.events.batches", "beat.stats.libbeat.output.events.dropped", "beat.stats.libbeat.output.events.duplicates", "beat.stats.libbeat.output.events.failed", "beat.stats.libbeat.output.events.toomany", "beat.stats.libbeat.output.events.total", "beat.stats.libbeat.output.read.bytes", "beat.stats.libbeat.output.read.errors", "beat.stats.libbeat.output.type", "beat.stats.libbeat.output.write.bytes", "beat.stats.libbeat.output.write.errors", "beat.stats.runtime.goroutines", "beat.stats.uptime.ms", "beat.type", "bytes_in", "bytes_out", "cassandra.no_request", "cassandra.request.headers.flags", "cassandra.request.headers.length", "cassandra.request.headers.op", "cassandra.request.headers.stream", "cassandra.request.headers.version", "cassandra.request.query", "cassandra.response.authentication.class", "cassandra.response.error.code", "cassandra.response.error.details.alive", "cassandra.response.error.details.arg_types", "cassandra.response.error.details.blockfor", "cassandra.response.error.details.data_present", "cassandra.response.error.details.function", "cassandra.response.error.details.keyspace", "cassandra.response.error.details.num_failures", "cassandra.response.error.details.read_consistency", "cassandra.response.error.details.received", "cassandra.response.error.details.required", "cassandra.response.error.details.stmt_id", "cassandra.response.error.details.table", "cassandra.response.error.details.write_type", "cassandra.response.error.msg", "cassandra.response.error.type", "cassandra.response.event.change", "cassandra.response.event.host", "cassandra.response.event.port", "cassandra.response.event.schema_change.args", "cassandra.response.event.schema_change.change", "cassandra.response.event.schema_change.keyspace", "cassandra.response.event.schema_change.name", "cassandra.response.event.schema_change.object", "cassandra.response.event.schema_change.table", "cassandra.response.event.schema_change.target", "cassandra.response.event.type", "cassandra.response.headers.flags", "cassandra.response.headers.length", "cassandra.response.headers.op", "cassandra.response.headers.stream", "cassandra.response.headers.version", "cassandra.response.result.keyspace", "cassandra.response.result.prepared.prepared_id", "cassandra.response.result.prepared.req_meta.col_count", "cassandra.response.result.prepared.req_meta.flags", "cassandra.response.result.prepared.req_meta.keyspace", "cassandra.response.result.prepared.req_meta.paging_state", "cassandra.response.result.prepared.req_meta.pkey_columns", "cassandra.response.result.prepared.req_meta.table", "cassandra.response.result.prepared.resp_meta.col_count", "cassandra.response.result.prepared.resp_meta.flags", "cassandra.response.result.prepared.resp_meta.keyspace", "cassandra.response.result.prepared.resp_meta.paging_state", "cassandra.response.result.prepared.resp_meta.pkey_columns", "cassandra.response.result.prepared.resp_meta.table", "cassandra.response.result.rows.meta.col_count", "cassandra.response.result.rows.meta.flags", "cassandra.response.result.rows.meta.keyspace", "cassandra.response.result.rows.meta.paging_state", "cassandra.response.result.rows.meta.pkey_columns", "cassandra.response.result.rows.meta.table", "cassandra.response.result.rows.num_rows", "cassandra.response.result.schema_change.args", "cassandra.response.result.schema_change.change", "cassandra.response.result.schema_change.keyspace", "cassandra.response.result.schema_change.name", "cassandra.response.result.schema_change.object", "cassandra.response.result.schema_change.table", "cassandra.response.result.schema_change.target", "cassandra.response.result.type", "cassandra.response.warnings", "ceph.cluster_disk.available.bytes", "ceph.cluster_disk.total.bytes", "ceph.cluster_disk.used.bytes", "ceph.cluster_health.overall_status", "ceph.cluster_health.timechecks.epoch", "ceph.cluster_health.timechecks.round.status", "ceph.cluster_health.timechecks.round.value", "ceph.cluster_status.degraded.objects", "ceph.cluster_status.degraded.ratio", "ceph.cluster_status.degraded.total", "ceph.cluster_status.misplace.objects", "ceph.cluster_status.misplace.ratio", "ceph.cluster_status.misplace.total", "ceph.cluster_status.osd.epoch", "ceph.cluster_status.osd.full", "ceph.cluster_status.osd.nearfull", "ceph.cluster_status.osd.num_in_osds", "ceph.cluster_status.osd.num_osds", "ceph.cluster_status.osd.num_remapped_pgs", "ceph.cluster_status.osd.num_up_osds", "ceph.cluster_status.pg.avail_bytes", "ceph.cluster_status.pg.data_bytes", "ceph.cluster_status.pg.total_bytes", "ceph.cluster_status.pg.used_bytes", "ceph.cluster_status.pg_state.count", "ceph.cluster_status.pg_state.state_name", "ceph.cluster_status.pg_state.version", "ceph.cluster_status.traffic.read_bytes", "ceph.cluster_status.traffic.read_op_per_sec", "ceph.cluster_status.traffic.write_bytes", "ceph.cluster_status.traffic.write_op_per_sec", "ceph.cluster_status.version", "ceph.mgr_osd_perf.id", "ceph.mgr_osd_perf.stats.apply_latency_ms", "ceph.mgr_osd_perf.stats.apply_latency_ns", "ceph.mgr_osd_perf.stats.commit_latency_ms", "ceph.mgr_osd_perf.stats.commit_latency_ns", "ceph.mgr_osd_pool_stats.pool_id", "ceph.mgr_osd_pool_stats.pool_name", "ceph.monitor_health.available.kb", "ceph.monitor_health.available.pct", "ceph.monitor_health.health", "ceph.monitor_health.last_updated", "ceph.monitor_health.name", "ceph.monitor_health.store_stats.last_updated", "ceph.monitor_health.store_stats.log.bytes", "ceph.monitor_health.store_stats.misc.bytes", "ceph.monitor_health.store_stats.sst.bytes", "ceph.monitor_health.store_stats.total.bytes", "ceph.monitor_health.total.kb", "ceph.monitor_health.used.kb", "ceph.osd_df.available.bytes", "ceph.osd_df.device_class", "ceph.osd_df.id", "ceph.osd_df.name", "ceph.osd_df.pg_num", "ceph.osd_df.total.byte", "ceph.osd_df.used.byte", "ceph.osd_df.used.pct", "ceph.osd_tree.children", "ceph.osd_tree.crush_weight", "ceph.osd_tree.depth", "ceph.osd_tree.device_class", "ceph.osd_tree.exists", "ceph.osd_tree.father", "ceph.osd_tree.id", "ceph.osd_tree.name", "ceph.osd_tree.primary_affinity", "ceph.osd_tree.reweight", "ceph.osd_tree.status", "ceph.osd_tree.type", "ceph.osd_tree.type_id", "ceph.pool_disk.id", "ceph.pool_disk.name", "ceph.pool_disk.stats.available.bytes", "ceph.pool_disk.stats.objects", "ceph.pool_disk.stats.used.bytes", "ceph.pool_disk.stats.used.kb", "client.address", "client.as.number", "client.as.organization.name", "client.as.organization.name.text", "client.bytes", "client.domain", "client.geo.city_name", "client.geo.continent_name", "client.geo.country_iso_code", "client.geo.country_name", "client.geo.location", "client.geo.name", "client.geo.region_iso_code", "client.geo.region_name", "client.ip", "client.mac", "client.nat.ip", "client.nat.port", "client.packets", "client.port", "client.process.args", "client.process.executable", "client.process.name", "client.process.start", "client.process.working_directory", "client.registered_domain", "client.subdomain", "client.top_level_domain", "client.user.domain", "client.user.email", "client.user.full_name", "client.user.full_name.text", "client.user.group.domain", "client.user.group.id", "client.user.group.name", "client.user.hash", "client.user.id", "client.user.name", "client.user.name.text", "client.user.roles", "cloud.account.id", "cloud.account.name", "cloud.availability_zone", "cloud.image.id", "cloud.instance.id", "cloud.instance.name", "cloud.machine.type", "cloud.project.id", "cloud.project.name", "cloud.provider", "cloud.region", "code_signature.exists", "code_signature.status", "code_signature.subject_name", "code_signature.trusted", "code_signature.valid", "consul.agent.autopilot.healthy", "consul.agent.runtime.alloc.bytes", "consul.agent.runtime.garbage_collector.pause.current.ns", "consul.agent.runtime.garbage_collector.pause.total.ns", "consul.agent.runtime.garbage_collector.runs", "consul.agent.runtime.goroutines", "consul.agent.runtime.heap_objects", "consul.agent.runtime.malloc_count", "consul.agent.runtime.sys.bytes", "container.id", "container.image.name", "container.image.tag", "container.name", "container.runtime", "couchbase.bucket.data.used.bytes", "couchbase.bucket.disk.fetches", "couchbase.bucket.disk.used.bytes", "couchbase.bucket.item_count", "couchbase.bucket.memory.used.bytes", "couchbase.bucket.name", "couchbase.bucket.ops_per_sec", "couchbase.bucket.quota.ram.bytes", "couchbase.bucket.quota.use.pct", "couchbase.bucket.type", "couchbase.cluster.hdd.free.bytes", "couchbase.cluster.hdd.quota.total.bytes", "couchbase.cluster.hdd.total.bytes", "couchbase.cluster.hdd.used.by_data.bytes", "couchbase.cluster.hdd.used.value.bytes", "couchbase.cluster.max_bucket_count", "couchbase.cluster.quota.index_memory.mb", "couchbase.cluster.quota.memory.mb", "couchbase.cluster.ram.quota.total.per_node.bytes", "couchbase.cluster.ram.quota.total.value.bytes", "couchbase.cluster.ram.quota.used.per_node.bytes", "couchbase.cluster.ram.quota.used.value.bytes", "couchbase.cluster.ram.total.bytes", "couchbase.cluster.ram.used.by_data.bytes", "couchbase.cluster.ram.used.value.bytes", "couchbase.node.cmd_get", "couchbase.node.couch.docs.data_size.bytes", "couchbase.node.couch.docs.disk_size.bytes", "couchbase.node.couch.spatial.data_size.bytes", "couchbase.node.couch.spatial.disk_size.bytes", "couchbase.node.couch.views.data_size.bytes", "couchbase.node.couch.views.disk_size.bytes", "couchbase.node.cpu_utilization_rate.pct", "couchbase.node.current_items.total", "couchbase.node.current_items.value", "couchbase.node.ep_bg_fetched", "couchbase.node.get_hits", "couchbase.node.hostname", "couchbase.node.mcd_memory.allocated.bytes", "couchbase.node.mcd_memory.reserved.bytes", "couchbase.node.memory.free.bytes", "couchbase.node.memory.total.bytes", "couchbase.node.memory.used.bytes", "couchbase.node.ops", "couchbase.node.swap.total.bytes", "couchbase.node.swap.used.bytes", "couchbase.node.uptime.sec", "couchbase.node.vb_replica_curr_items", "couchdb.server.couchdb.auth_cache_hits", "couchdb.server.couchdb.auth_cache_misses", "couchdb.server.couchdb.database_reads", "couchdb.server.couchdb.database_writes", "couchdb.server.couchdb.open_databases", "couchdb.server.couchdb.open_os_files", "couchdb.server.couchdb.request_time", "couchdb.server.httpd.bulk_requests", "couchdb.server.httpd.clients_requesting_changes", "couchdb.server.httpd.requests", "couchdb.server.httpd.temporary_view_reads", "couchdb.server.httpd.view_reads", "couchdb.server.httpd_request_methods.COPY", "couchdb.server.httpd_request_methods.DELETE", "couchdb.server.httpd_request_methods.GET", "couchdb.server.httpd_request_methods.HEAD", "couchdb.server.httpd_request_methods.POST", "couchdb.server.httpd_request_methods.PUT", "couchdb.server.httpd_status_codes.200", "couchdb.server.httpd_status_codes.201", "couchdb.server.httpd_status_codes.202", "couchdb.server.httpd_status_codes.301", "couchdb.server.httpd_status_codes.304", "couchdb.server.httpd_status_codes.400", "couchdb.server.httpd_status_codes.401", "couchdb.server.httpd_status_codes.403", "couchdb.server.httpd_status_codes.404", "couchdb.server.httpd_status_codes.405", "couchdb.server.httpd_status_codes.409", "couchdb.server.httpd_status_codes.412", "couchdb.server.httpd_status_codes.500", "destination.address", "destination.as.number", "destination.as.organization.name", "destination.as.organization.name.text", "destination.bytes", "destination.domain", "destination.geo.city_name", "destination.geo.continent_name", "destination.geo.country_iso_code", "destination.geo.country_name", "destination.geo.location", "destination.geo.name", "destination.geo.region_iso_code", "destination.geo.region_name", "destination.ip", "destination.mac", "destination.nat.ip", "destination.nat.port", "destination.packets", "destination.port", "destination.registered_domain", "destination.subdomain", "destination.top_level_domain", "destination.user.domain", "destination.user.email", "destination.user.full_name", "destination.user.full_name.text", "destination.user.group.domain", "destination.user.group.id", "destination.user.group.name", "destination.user.hash", "destination.user.id", "destination.user.name", "destination.user.name.text", "destination.user.roles", "dhcpv4.assigned_ip", "dhcpv4.client_ip", "dhcpv4.client_mac", "dhcpv4.flags", "dhcpv4.hardware_type", "dhcpv4.hops", "dhcpv4.op_code", "dhcpv4.option.boot_file_name", "dhcpv4.option.broadcast_address", "dhcpv4.option.class_identifier", "dhcpv4.option.dns_servers", "dhcpv4.option.domain_name", "dhcpv4.option.hostname", "dhcpv4.option.ip_address_lease_time_sec", "dhcpv4.option.max_dhcp_message_size", "dhcpv4.option.message", "dhcpv4.option.message_type", "dhcpv4.option.ntp_servers", "dhcpv4.option.parameter_request_list", "dhcpv4.option.rebinding_time_sec", "dhcpv4.option.renewal_time_sec", "dhcpv4.option.requested_ip_address", "dhcpv4.option.router", "dhcpv4.option.server_identifier", "dhcpv4.option.subnet_mask", "dhcpv4.option.time_servers", "dhcpv4.option.utc_time_offset_sec", "dhcpv4.relay_ip", "dhcpv4.seconds", "dhcpv4.server_ip", "dhcpv4.server_name", "dhcpv4.transaction_id", "dll.code_signature.exists", "dll.code_signature.status", "dll.code_signature.subject_name", "dll.code_signature.trusted", "dll.code_signature.valid", "dll.hash.md5", "dll.hash.sha1", "dll.hash.sha256", "dll.hash.sha512", "dll.name", "dll.path", "dll.pe.architecture", "dll.pe.company", "dll.pe.description", "dll.pe.file_version", "dll.pe.imphash", "dll.pe.original_file_name", "dll.pe.product", "dns.additionals.class", "dns.additionals.data", "dns.additionals.name", "dns.additionals.ttl", "dns.additionals.type", "dns.additionals_count", "dns.answers.class", "dns.answers.data", "dns.answers.name", "dns.answers.ttl", "dns.answers.type", "dns.answers_count", "dns.authorities.class", "dns.authorities.name", "dns.authorities.type", "dns.authorities_count", "dns.flags.authentic_data", "dns.flags.authoritative", "dns.flags.checking_disabled", "dns.flags.recursion_available", "dns.flags.recursion_desired", "dns.flags.truncated_response", "dns.header_flags", "dns.id", "dns.op_code", "dns.opt.do", "dns.opt.ext_rcode", "dns.opt.udp_size", "dns.opt.version", "dns.question.class", "dns.question.etld_plus_one", "dns.question.name", "dns.question.registered_domain", "dns.question.subdomain", "dns.question.top_level_domain", "dns.question.type", "dns.resolved_ip", "dns.response_code", "dns.type", "docker.container.command", "docker.container.created", "docker.container.ip_addresses", "docker.container.size.root_fs", "docker.container.size.rw", "docker.container.status", "docker.container.tags", "docker.cpu.kernel.norm.pct", "docker.cpu.kernel.pct", "docker.cpu.kernel.ticks", "docker.cpu.system.norm.pct", "docker.cpu.system.pct", "docker.cpu.system.ticks", "docker.cpu.total.norm.pct", "docker.cpu.total.pct", "docker.cpu.user.norm.pct", "docker.cpu.user.pct", "docker.cpu.user.ticks", "docker.diskio.read.bytes", "docker.diskio.read.ops", "docker.diskio.read.queued", "docker.diskio.read.rate", "docker.diskio.read.service_time", "docker.diskio.read.wait_time", "docker.diskio.reads", "docker.diskio.summary.bytes", "docker.diskio.summary.ops", "docker.diskio.summary.queued", "docker.diskio.summary.rate", "docker.diskio.summary.service_time", "docker.diskio.summary.wait_time", "docker.diskio.total", "docker.diskio.write.bytes", "docker.diskio.write.ops", "docker.diskio.write.queued", "docker.diskio.write.rate", "docker.diskio.write.service_time", "docker.diskio.write.wait_time", "docker.diskio.writes", "docker.event.action", "docker.event.actor.id", "docker.event.from", "docker.event.id", "docker.event.status", "docker.event.type", "docker.healthcheck.event.end_date", "docker.healthcheck.event.exit_code", "docker.healthcheck.event.output", "docker.healthcheck.event.start_date", "docker.healthcheck.failingstreak", "docker.healthcheck.status", "docker.image.created", "docker.image.id.current", "docker.image.id.parent", "docker.image.size.regular", "docker.image.size.virtual", "docker.image.tags", "docker.info.containers.paused", "docker.info.containers.running", "docker.info.containers.stopped", "docker.info.containers.total", "docker.info.id", "docker.info.images", "docker.memory.commit.peak", "docker.memory.commit.total", "docker.memory.fail.count", "docker.memory.limit", "docker.memory.private_working_set.total", "docker.memory.rss.pct", "docker.memory.rss.total", "docker.memory.usage.max", "docker.memory.usage.pct", "docker.memory.usage.total", "docker.network.in.bytes", "docker.network.in.dropped", "docker.network.in.errors", "docker.network.in.packets", "docker.network.inbound.bytes", "docker.network.inbound.dropped", "docker.network.inbound.errors", "docker.network.inbound.packets", "docker.network.interface", "docker.network.out.bytes", "docker.network.out.dropped", "docker.network.out.errors", "docker.network.out.packets", "docker.network.outbound.bytes", "docker.network.outbound.dropped", "docker.network.outbound.errors", "docker.network.outbound.packets", "ecs.version", "elasticsearch.ccr.follower.global_checkpoint", "elasticsearch.ccr.follower.index", "elasticsearch.ccr.follower.operations_written", "elasticsearch.ccr.follower.shard.number", "elasticsearch.ccr.follower.time_since_last_read.ms", "elasticsearch.ccr.leader.index", "elasticsearch.ccr.leader.max_seq_no", "elasticsearch.cluster.id", "elasticsearch.cluster.name", "elasticsearch.cluster.pending_task.insert_order", "elasticsearch.cluster.pending_task.priority", "elasticsearch.cluster.pending_task.source", "elasticsearch.cluster.pending_task.time_in_queue.ms", "elasticsearch.cluster.state.id", "elasticsearch.cluster.stats.indices.count", "elasticsearch.cluster.stats.indices.fielddata.memory.bytes", "elasticsearch.cluster.stats.indices.shards.count", "elasticsearch.cluster.stats.indices.shards.primaries", "elasticsearch.cluster.stats.nodes.count", "elasticsearch.cluster.stats.nodes.data", "elasticsearch.cluster.stats.nodes.master", "elasticsearch.cluster.stats.status", "elasticsearch.enrich.executed_searches.total", "elasticsearch.enrich.queue.size", "elasticsearch.enrich.remote_requests.current", "elasticsearch.enrich.remote_requests.total", "elasticsearch.index.name", "elasticsearch.index.recovery.id", "elasticsearch.index.recovery.primary", "elasticsearch.index.recovery.source.host", "elasticsearch.index.recovery.source.id", "elasticsearch.index.recovery.source.name", "elasticsearch.index.recovery.stage", "elasticsearch.index.recovery.target.host", "elasticsearch.index.recovery.target.id", "elasticsearch.index.recovery.target.name", "elasticsearch.index.recovery.type", "elasticsearch.index.summary.primaries.docs.count", "elasticsearch.index.summary.primaries.docs.deleted", "elasticsearch.index.summary.primaries.segments.count", "elasticsearch.index.summary.primaries.segments.memory.bytes", "elasticsearch.index.summary.primaries.store.size.bytes", "elasticsearch.index.summary.total.docs.count", "elasticsearch.index.summary.total.docs.deleted", "elasticsearch.index.summary.total.segments.count", "elasticsearch.index.summary.total.segments.memory.bytes", "elasticsearch.index.summary.total.store.size.bytes", "elasticsearch.index.total.docs.count", "elasticsearch.index.total.docs.deleted", "elasticsearch.index.total.segments.count", "elasticsearch.index.total.segments.memory.bytes", "elasticsearch.index.total.store.size.bytes", "elasticsearch.ml.job.data_counts.invalid_date_count", "elasticsearch.ml.job.data_counts.processed_record_count", "elasticsearch.ml.job.id", "elasticsearch.ml.job.state", "elasticsearch.node.id", "elasticsearch.node.jvm.memory.heap.init.bytes", "elasticsearch.node.jvm.memory.heap.max.bytes", "elasticsearch.node.jvm.memory.nonheap.init.bytes", "elasticsearch.node.jvm.memory.nonheap.max.bytes", "elasticsearch.node.jvm.version", "elasticsearch.node.name", "elasticsearch.node.process.mlockall", "elasticsearch.node.stats.fs.summary.available.bytes", "elasticsearch.node.stats.fs.summary.free.bytes", "elasticsearch.node.stats.fs.summary.total.bytes", "elasticsearch.node.stats.indices.docs.count", "elasticsearch.node.stats.indices.docs.deleted", "elasticsearch.node.stats.indices.segments.count", "elasticsearch.node.stats.indices.segments.memory.bytes", "elasticsearch.node.stats.indices.store.size.bytes", "elasticsearch.node.stats.jvm.gc.collectors.old.collection.count", "elasticsearch.node.stats.jvm.gc.collectors.old.collection.ms", "elasticsearch.node.stats.jvm.gc.collectors.young.collection.count", "elasticsearch.node.stats.jvm.gc.collectors.young.collection.ms", "elasticsearch.node.stats.jvm.mem.pools.old.max.bytes", "elasticsearch.node.stats.jvm.mem.pools.old.peak.bytes", "elasticsearch.node.stats.jvm.mem.pools.old.peak_max.bytes", "elasticsearch.node.stats.jvm.mem.pools.old.used.bytes", "elasticsearch.node.stats.jvm.mem.pools.survivor.max.bytes", "elasticsearch.node.stats.jvm.mem.pools.survivor.peak.bytes", "elasticsearch.node.stats.jvm.mem.pools.survivor.peak_max.bytes", "elasticsearch.node.stats.jvm.mem.pools.survivor.used.bytes", "elasticsearch.node.stats.jvm.mem.pools.young.max.bytes", "elasticsearch.node.stats.jvm.mem.pools.young.peak.bytes", "elasticsearch.node.stats.jvm.mem.pools.young.peak_max.bytes", "elasticsearch.node.stats.jvm.mem.pools.young.used.bytes", "elasticsearch.node.version", "elasticsearch.shard.number", "elasticsearch.shard.primary", "elasticsearch.shard.relocating_node.name", "elasticsearch.shard.state", "envoyproxy.server.cluster_manager.active_clusters", "envoyproxy.server.cluster_manager.cluster_added", "envoyproxy.server.cluster_manager.cluster_modified", "envoyproxy.server.cluster_manager.cluster_removed", "envoyproxy.server.cluster_manager.cluster_updated", "envoyproxy.server.cluster_manager.cluster_updated_via_merge", "envoyproxy.server.cluster_manager.update_merge_cancelled", "envoyproxy.server.cluster_manager.update_out_of_merge_window", "envoyproxy.server.cluster_manager.warming_clusters", "envoyproxy.server.filesystem.flushed_by_timer", "envoyproxy.server.filesystem.reopen_failed", "envoyproxy.server.filesystem.write_buffered", "envoyproxy.server.filesystem.write_completed", "envoyproxy.server.filesystem.write_failed", "envoyproxy.server.filesystem.write_total_buffered", "envoyproxy.server.http2.header_overflow", "envoyproxy.server.http2.headers_cb_no_stream", "envoyproxy.server.http2.rx_messaging_error", "envoyproxy.server.http2.rx_reset", "envoyproxy.server.http2.too_many_header_frames", "envoyproxy.server.http2.trailers", "envoyproxy.server.http2.tx_reset", "envoyproxy.server.listener_manager.listener_added", "envoyproxy.server.listener_manager.listener_create_failure", "envoyproxy.server.listener_manager.listener_create_success", "envoyproxy.server.listener_manager.listener_modified", "envoyproxy.server.listener_manager.listener_removed", "envoyproxy.server.listener_manager.listener_stopped", "envoyproxy.server.listener_manager.total_listeners_active", "envoyproxy.server.listener_manager.total_listeners_draining", "envoyproxy.server.listener_manager.total_listeners_warming", "envoyproxy.server.runtime.admin_overrides_active", "envoyproxy.server.runtime.deprecated_feature_use", "envoyproxy.server.runtime.load_error", "envoyproxy.server.runtime.load_success", "envoyproxy.server.runtime.num_keys", "envoyproxy.server.runtime.num_layers", "envoyproxy.server.runtime.override_dir_exists", "envoyproxy.server.runtime.override_dir_not_exists", "envoyproxy.server.server.concurrency", "envoyproxy.server.server.days_until_first_cert_expiring", "envoyproxy.server.server.debug_assertion_failures", "envoyproxy.server.server.dynamic_unknown_fields", "envoyproxy.server.server.hot_restart_epoch", "envoyproxy.server.server.live", "envoyproxy.server.server.memory_allocated", "envoyproxy.server.server.memory_heap_size", "envoyproxy.server.server.parent_connections", "envoyproxy.server.server.state", "envoyproxy.server.server.static_unknown_fields", "envoyproxy.server.server.stats_recent_lookups", "envoyproxy.server.server.total_connections", "envoyproxy.server.server.uptime", "envoyproxy.server.server.version", "envoyproxy.server.server.watchdog_mega_miss", "envoyproxy.server.server.watchdog_miss", "envoyproxy.server.stats.overflow", "error.code", "error.id", "error.message", "error.stack_trace", "error.stack_trace.text", "error.type", "etcd.api_version", "etcd.disk.backend_commit_duration.ns.count", "etcd.disk.backend_commit_duration.ns.sum", "etcd.disk.mvcc_db_total_size.bytes", "etcd.disk.wal_fsync_duration.ns.count", "etcd.disk.wal_fsync_duration.ns.sum", "etcd.leader.followers.counts.followers.counts.fail", "etcd.leader.followers.counts.followers.counts.success", "etcd.leader.followers.latency.follower.latency.standardDeviation", "etcd.leader.followers.latency.followers.latency.average", "etcd.leader.followers.latency.followers.latency.current", "etcd.leader.followers.latency.followers.latency.maximum", "etcd.leader.followers.latency.followers.latency.minimum", "etcd.leader.leader", "etcd.memory.go_memstats_alloc.bytes", "etcd.network.client_grpc_received.bytes", "etcd.network.client_grpc_sent.bytes", "etcd.self.id", "etcd.self.leaderinfo.leader", "etcd.self.leaderinfo.starttime", "etcd.self.leaderinfo.uptime", "etcd.self.name", "etcd.self.recv.appendrequest.count", "etcd.self.recv.bandwidthrate", "etcd.self.recv.pkgrate", "etcd.self.send.appendrequest.count", "etcd.self.send.bandwidthrate", "etcd.self.send.pkgrate", "etcd.self.starttime", "etcd.self.state", "etcd.server.grpc_handled.count", "etcd.server.grpc_started.count", "etcd.server.has_leader", "etcd.server.leader_changes.count", "etcd.server.proposals_committed.count", "etcd.server.proposals_failed.count", "etcd.server.proposals_pending.count", "etcd.store.compareanddelete.fail", "etcd.store.compareanddelete.success", "etcd.store.compareandswap.fail", "etcd.store.compareandswap.success", "etcd.store.create.fail", "etcd.store.create.success", "etcd.store.delete.fail", "etcd.store.delete.success", "etcd.store.expire.count", "etcd.store.gets.fail", "etcd.store.gets.success", "etcd.store.sets.fail", "etcd.store.sets.success", "etcd.store.update.fail", "etcd.store.update.success", "etcd.store.watchers", "event.action", "event.category", "event.code", "event.created", "event.dataset", "event.duration", "event.end", "event.hash", "event.id", "event.ingested", "event.kind", "event.module", "event.original", "event.outcome", "event.provider", "event.reason", "event.reference", "event.risk_score", "event.risk_score_norm", "event.sequence", "event.severity", "event.start", "event.timezone", "event.type", "event.url", "file.accessed", "file.attributes", "file.code_signature.exists", "file.code_signature.status", "file.code_signature.subject_name", "file.code_signature.trusted", "file.code_signature.valid", "file.created", "file.ctime", "file.device", "file.directory", "file.drive_letter", "file.extension", "file.gid", "file.group", "file.hash.md5", "file.hash.sha1", "file.hash.sha256", "file.hash.sha512", "file.inode", "file.mime_type", "file.mode", "file.mtime", "file.name", "file.owner", "file.path", "file.path.text", "file.pe.architecture", "file.pe.company", "file.pe.description", "file.pe.file_version", "file.pe.imphash", "file.pe.original_file_name", "file.pe.product", "file.size", "file.target_path", "file.target_path.text", "file.type", "file.uid", "file.x509.alternative_names", "file.x509.issuer.common_name", "file.x509.issuer.country", "file.x509.issuer.distinguished_name", "file.x509.issuer.locality", "file.x509.issuer.organization", "file.x509.issuer.organizational_unit", "file.x509.issuer.state_or_province", "file.x509.not_after", "file.x509.not_before", "file.x509.public_key_algorithm", "file.x509.public_key_curve", "file.x509.public_key_exponent", "file.x509.public_key_size", "file.x509.serial_number", "file.x509.signature_algorithm", "file.x509.subject.common_name", "file.x509.subject.country", "file.x509.subject.distinguished_name", "file.x509.subject.locality", "file.x509.subject.organization", "file.x509.subject.organizational_unit", "file.x509.subject.state_or_province", "file.x509.version_number", "flow.final", "flow.id", "flow.vlan", "geo.city_name", "geo.continent_name", "geo.country_iso_code", "geo.country_name", "geo.location", "geo.name", "geo.region_iso_code", "geo.region_name", "golang.expvar.cmdline", "golang.heap.allocations.active", "golang.heap.allocations.allocated", "golang.heap.allocations.frees", "golang.heap.allocations.idle", "golang.heap.allocations.mallocs", "golang.heap.allocations.objects", "golang.heap.allocations.total", "golang.heap.cmdline", "golang.heap.gc.cpu_fraction", "golang.heap.gc.next_gc_limit", "golang.heap.gc.pause.avg.ns", "golang.heap.gc.pause.count", "golang.heap.gc.pause.max.ns", "golang.heap.gc.pause.sum.ns", "golang.heap.gc.total_count", "golang.heap.gc.total_pause.ns", "golang.heap.system.obtained", "golang.heap.system.released", "golang.heap.system.stack", "golang.heap.system.total", "graphite.server.example", "group.domain", "group.id", "group.name", "haproxy.info.busy_polling", "haproxy.info.bytes.out.rate", "haproxy.info.bytes.out.total", "haproxy.info.compress.bps.in", "haproxy.info.compress.bps.out", "haproxy.info.compress.bps.rate_limit", "haproxy.info.connection.current", "haproxy.info.connection.hard_max", "haproxy.info.connection.max", "haproxy.info.connection.rate.limit", "haproxy.info.connection.rate.max", "haproxy.info.connection.rate.value", "haproxy.info.connection.ssl.current", "haproxy.info.connection.ssl.max", "haproxy.info.connection.ssl.total", "haproxy.info.connection.total", "haproxy.info.dropped_logs", "haproxy.info.failed_resolutions", "haproxy.info.idle.pct", "haproxy.info.jobs", "haproxy.info.listeners", "haproxy.info.memory.max.bytes", "haproxy.info.peers.active", "haproxy.info.peers.connected", "haproxy.info.pipes.free", "haproxy.info.pipes.max", "haproxy.info.pipes.used", "haproxy.info.pool.allocated", "haproxy.info.pool.failed", "haproxy.info.pool.used", "haproxy.info.process_num", "haproxy.info.processes", "haproxy.info.requests.max", "haproxy.info.requests.total", "haproxy.info.run_queue", "haproxy.info.session.rate.limit", "haproxy.info.session.rate.max", "haproxy.info.session.rate.value", "haproxy.info.sockets.max", "haproxy.info.ssl.backend.key_rate.max", "haproxy.info.ssl.backend.key_rate.value", "haproxy.info.ssl.cache_misses", "haproxy.info.ssl.cached_lookups", "haproxy.info.ssl.frontend.key_rate.max", "haproxy.info.ssl.frontend.key_rate.value", "haproxy.info.ssl.frontend.session_reuse.pct", "haproxy.info.ssl.rate.limit", "haproxy.info.ssl.rate.max", "haproxy.info.ssl.rate.value", "haproxy.info.stopping", "haproxy.info.tasks", "haproxy.info.threads", "haproxy.info.ulimit_n", "haproxy.info.unstoppable_jobs", "haproxy.info.uptime.sec", "haproxy.info.zlib_mem_usage.max", "haproxy.info.zlib_mem_usage.value", "haproxy.stat.agent.check.description", "haproxy.stat.agent.check.fall", "haproxy.stat.agent.check.health", "haproxy.stat.agent.check.rise", "haproxy.stat.agent.code", "haproxy.stat.agent.description", "haproxy.stat.agent.duration", "haproxy.stat.agent.fall", "haproxy.stat.agent.health", "haproxy.stat.agent.rise", "haproxy.stat.agent.status", "haproxy.stat.check.agent.last", "haproxy.stat.check.code", "haproxy.stat.check.down", "haproxy.stat.check.duration", "haproxy.stat.check.failed", "haproxy.stat.check.health.fail", "haproxy.stat.check.health.last", "haproxy.stat.check.status", "haproxy.stat.client.aborted", "haproxy.stat.component_type", "haproxy.stat.compressor.bypassed.bytes", "haproxy.stat.compressor.in.bytes", "haproxy.stat.compressor.out.bytes", "haproxy.stat.compressor.response.bytes", "haproxy.stat.connection.attempt.total", "haproxy.stat.connection.cache.hits", "haproxy.stat.connection.cache.lookup.total", "haproxy.stat.connection.idle.limit", "haproxy.stat.connection.idle.total", "haproxy.stat.connection.rate", "haproxy.stat.connection.rate_max", "haproxy.stat.connection.retried", "haproxy.stat.connection.reuse.total", "haproxy.stat.connection.time.avg", "haproxy.stat.connection.total", "haproxy.stat.cookie", "haproxy.stat.downtime", "haproxy.stat.header.rewrite.failed.total", "haproxy.stat.in.bytes", "haproxy.stat.last_change", "haproxy.stat.load_balancing_algorithm", "haproxy.stat.out.bytes", "haproxy.stat.proxy.id", "haproxy.stat.proxy.mode", "haproxy.stat.proxy.name", "haproxy.stat.queue.limit", "haproxy.stat.queue.time.avg", "haproxy.stat.request.connection.errors", "haproxy.stat.request.denied", "haproxy.stat.request.denied_by_connection_rules", "haproxy.stat.request.denied_by_session_rules", "haproxy.stat.request.errors", "haproxy.stat.request.intercepted", "haproxy.stat.request.queued.current", "haproxy.stat.request.queued.max", "haproxy.stat.request.rate.max", "haproxy.stat.request.rate.value", "haproxy.stat.request.redispatched", "haproxy.stat.request.total", "haproxy.stat.response.denied", "haproxy.stat.response.errors", "haproxy.stat.response.http.1xx", "haproxy.stat.response.http.2xx", "haproxy.stat.response.http.3xx", "haproxy.stat.response.http.4xx", "haproxy.stat.response.http.5xx", "haproxy.stat.response.http.other", "haproxy.stat.response.time.avg", "haproxy.stat.selected.total", "haproxy.stat.server.aborted", "haproxy.stat.server.active", "haproxy.stat.server.backup", "haproxy.stat.server.id", "haproxy.stat.service_name", "haproxy.stat.session.current", "haproxy.stat.session.limit", "haproxy.stat.session.max", "haproxy.stat.session.rate.limit", "haproxy.stat.session.rate.max", "haproxy.stat.session.rate.value", "haproxy.stat.session.total", "haproxy.stat.source.address", "haproxy.stat.status", "haproxy.stat.throttle.pct", "haproxy.stat.tracked.id", "haproxy.stat.weight", "hash.md5", "hash.sha1", "hash.sha256", "hash.sha512", "host.architecture", "host.containerized", "host.cpu.pct", "host.domain", "host.geo.city_name", "host.geo.continent_name", "host.geo.country_iso_code", "host.geo.country_name", "host.geo.location", "host.geo.name", "host.geo.region_iso_code", "host.geo.region_name", "host.hostname", "host.id", "host.ip", "host.mac", "host.name", "host.network.in.bytes", "host.network.in.packets", "host.network.out.bytes", "host.network.out.packets", "host.os.build", "host.os.codename", "host.os.family", "host.os.full", "host.os.full.text", "host.os.kernel", "host.os.name", "host.os.name.text", "host.os.platform", "host.os.version", "host.type", "host.uptime", "host.user.domain", "host.user.email", "host.user.full_name", "host.user.full_name.text", "host.user.group.domain", "host.user.group.id", "host.user.group.name", "host.user.hash", "host.user.id", "host.user.name", "host.user.name.text", "host.user.roles", "http.request.body.bytes", "http.request.body.content", "http.request.body.content.text", "http.request.bytes", "http.request.headers.content-length", "http.request.method", "http.request.mime_type", "http.request.referrer", "http.response.body.bytes", "http.response.body.content", "http.response.body.content.text", "http.response.bytes", "http.response.code", "http.response.headers.content-length", "http.response.headers.content-type", "http.response.mime_type", "http.response.phrase", "http.response.status_code", "http.response.status_phrase", "http.version", "icmp.request.code", "icmp.request.message", "icmp.request.type", "icmp.response.code", "icmp.response.message", "icmp.response.type", "icmp.version", "interface.alias", "interface.id", "interface.name", "jolokia.agent.id", "jolokia.agent.version", "jolokia.secured", "jolokia.server.product", "jolokia.server.vendor", "jolokia.server.version", "jolokia.url", "kafka.broker.address", "kafka.broker.id", "kafka.broker.log.flush_rate", "kafka.broker.mbean", "kafka.broker.messages_in", "kafka.broker.net.in.bytes_per_sec", "kafka.broker.net.out.bytes_per_sec", "kafka.broker.net.rejected.bytes_per_sec", "kafka.broker.replication.leader_elections", "kafka.broker.replication.unclean_leader_elections", "kafka.broker.request.channel.queue.size", "kafka.broker.request.fetch.failed", "kafka.broker.request.fetch.failed_per_second", "kafka.broker.request.produce.failed", "kafka.broker.request.produce.failed_per_second", "kafka.broker.session.zookeeper.disconnect", "kafka.broker.session.zookeeper.expire", "kafka.broker.session.zookeeper.readonly", "kafka.broker.session.zookeeper.sync", "kafka.broker.topic.messages_in", "kafka.broker.topic.net.in.bytes_per_sec", "kafka.broker.topic.net.out.bytes_per_sec", "kafka.broker.topic.net.rejected.bytes_per_sec", "kafka.consumer.bytes_consumed", "kafka.consumer.fetch_rate", "kafka.consumer.in.bytes_per_sec", "kafka.consumer.kafka_commits", "kafka.consumer.max_lag", "kafka.consumer.mbean", "kafka.consumer.messages_in", "kafka.consumer.records_consumed", "kafka.consumer.zookeeper_commits", "kafka.consumergroup.broker.address", "kafka.consumergroup.broker.id", "kafka.consumergroup.client.host", "kafka.consumergroup.client.id", "kafka.consumergroup.client.member_id", "kafka.consumergroup.consumer_lag", "kafka.consumergroup.error.code", "kafka.consumergroup.id", "kafka.consumergroup.meta", "kafka.consumergroup.offset", "kafka.consumergroup.partition", "kafka.consumergroup.topic", "kafka.partition.broker.address", "kafka.partition.broker.id", "kafka.partition.id", "kafka.partition.offset.newest", "kafka.partition.offset.oldest", "kafka.partition.partition.error.code", "kafka.partition.partition.id", "kafka.partition.partition.insync_replica", "kafka.partition.partition.is_leader", "kafka.partition.partition.leader", "kafka.partition.partition.replica", "kafka.partition.topic.error.code", "kafka.partition.topic.name", "kafka.partition.topic_broker_id", "kafka.partition.topic_id", "kafka.producer.available_buffer_bytes", "kafka.producer.batch_size_avg", "kafka.producer.batch_size_max", "kafka.producer.io_wait", "kafka.producer.mbean", "kafka.producer.message_rate", "kafka.producer.out.bytes_per_sec", "kafka.producer.record_error_rate", "kafka.producer.record_retry_rate", "kafka.producer.record_send_rate", "kafka.producer.record_size_avg", "kafka.producer.record_size_max", "kafka.producer.records_per_request", "kafka.producer.request_rate", "kafka.producer.response_rate", "kafka.topic.error.code", "kafka.topic.name", "kibana.stats.concurrent_connections", "kibana.stats.host.name", "kibana.stats.index", "kibana.stats.name", "kibana.stats.process.event_loop_delay.ms", "kibana.stats.process.memory.heap.size_limit.bytes", "kibana.stats.process.memory.heap.total.bytes", "kibana.stats.process.memory.heap.uptime.ms", "kibana.stats.process.memory.heap.used.bytes", "kibana.stats.request.disconnects", "kibana.stats.request.total", "kibana.stats.response_time.avg.ms", "kibana.stats.response_time.max.ms", "kibana.stats.snapshot", "kibana.stats.status", "kibana.status.metrics.concurrent_connections", "kibana.status.metrics.requests.disconnects", "kibana.status.metrics.requests.total", "kibana.status.name", "kibana.status.status.overall.state", "kubernetes.apiserver.audit.event.count", "kubernetes.apiserver.audit.rejected.count", "kubernetes.apiserver.client.request.count", "kubernetes.apiserver.etcd.object.count", "kubernetes.apiserver.http.request.count", "kubernetes.apiserver.http.request.duration.us.count", "kubernetes.apiserver.http.request.duration.us.sum", "kubernetes.apiserver.http.request.size.bytes.count", "kubernetes.apiserver.http.request.size.bytes.sum", "kubernetes.apiserver.http.response.size.bytes.count", "kubernetes.apiserver.http.response.size.bytes.sum", "kubernetes.apiserver.process.cpu.sec", "kubernetes.apiserver.process.fds.open.count", "kubernetes.apiserver.process.memory.resident.bytes", "kubernetes.apiserver.process.memory.virtual.bytes", "kubernetes.apiserver.process.started.sec", "kubernetes.apiserver.request.client", "kubernetes.apiserver.request.code", "kubernetes.apiserver.request.component", "kubernetes.apiserver.request.content_type", "kubernetes.apiserver.request.count", "kubernetes.apiserver.request.current.count", "kubernetes.apiserver.request.dry_run", "kubernetes.apiserver.request.duration.us.count", "kubernetes.apiserver.request.duration.us.sum", "kubernetes.apiserver.request.group", "kubernetes.apiserver.request.handler", "kubernetes.apiserver.request.host", "kubernetes.apiserver.request.kind", "kubernetes.apiserver.request.latency.count", "kubernetes.apiserver.request.latency.sum", "kubernetes.apiserver.request.longrunning.count", "kubernetes.apiserver.request.method", "kubernetes.apiserver.request.resource", "kubernetes.apiserver.request.scope", "kubernetes.apiserver.request.subresource", "kubernetes.apiserver.request.verb", "kubernetes.apiserver.request.version", "kubernetes.container.cpu.limit.cores", "kubernetes.container.cpu.limit.nanocores", "kubernetes.container.cpu.request.cores", "kubernetes.container.cpu.request.nanocores", "kubernetes.container.cpu.usage.core.ns", "kubernetes.container.cpu.usage.limit.pct", "kubernetes.container.cpu.usage.nanocores", "kubernetes.container.cpu.usage.node.pct", "kubernetes.container.id", "kubernetes.container.image", "kubernetes.container.logs.available.bytes", "kubernetes.container.logs.capacity.bytes", "kubernetes.container.logs.inodes.count", "kubernetes.container.logs.inodes.free", "kubernetes.container.logs.inodes.used", "kubernetes.container.logs.used.bytes", "kubernetes.container.memory.available.bytes", "kubernetes.container.memory.limit.bytes", "kubernetes.container.memory.majorpagefaults", "kubernetes.container.memory.pagefaults", "kubernetes.container.memory.request.bytes", "kubernetes.container.memory.rss.bytes", "kubernetes.container.memory.usage.bytes", "kubernetes.container.memory.usage.limit.pct", "kubernetes.container.memory.usage.node.pct", "kubernetes.container.memory.workingset.bytes", "kubernetes.container.name", "kubernetes.container.rootfs.available.bytes", "kubernetes.container.rootfs.capacity.bytes", "kubernetes.container.rootfs.inodes.used", "kubernetes.container.rootfs.used.bytes", "kubernetes.container.start_time", "kubernetes.container.status.phase", "kubernetes.container.status.ready", "kubernetes.container.status.reason", "kubernetes.container.status.restarts", "kubernetes.controllermanager.client.request.count", "kubernetes.controllermanager.code", "kubernetes.controllermanager.handler", "kubernetes.controllermanager.host", "kubernetes.controllermanager.http.request.count", "kubernetes.controllermanager.http.request.duration.us.count", "kubernetes.controllermanager.http.request.duration.us.sum", "kubernetes.controllermanager.http.request.size.bytes.count", "kubernetes.controllermanager.http.request.size.bytes.sum", "kubernetes.controllermanager.http.response.size.bytes.count", "kubernetes.controllermanager.http.response.size.bytes.sum", "kubernetes.controllermanager.leader.is_master", "kubernetes.controllermanager.method", "kubernetes.controllermanager.name", "kubernetes.controllermanager.node.collector.count", "kubernetes.controllermanager.node.collector.eviction.count", "kubernetes.controllermanager.node.collector.health.pct", "kubernetes.controllermanager.node.collector.unhealthy.count", "kubernetes.controllermanager.process.cpu.sec", "kubernetes.controllermanager.process.fds.open.count", "kubernetes.controllermanager.process.memory.resident.bytes", "kubernetes.controllermanager.process.memory.virtual.bytes", "kubernetes.controllermanager.process.started.sec", "kubernetes.controllermanager.workqueue.adds.count", "kubernetes.controllermanager.workqueue.depth.count", "kubernetes.controllermanager.workqueue.longestrunning.sec", "kubernetes.controllermanager.workqueue.retries.count", "kubernetes.controllermanager.workqueue.unfinished.sec", "kubernetes.controllermanager.zone", "kubernetes.cronjob.active.count", "kubernetes.cronjob.concurrency", "kubernetes.cronjob.created.sec", "kubernetes.cronjob.deadline.sec", "kubernetes.cronjob.is_suspended", "kubernetes.cronjob.last_schedule.sec", "kubernetes.cronjob.name", "kubernetes.cronjob.next_schedule.sec", "kubernetes.cronjob.schedule", "kubernetes.daemonset.name", "kubernetes.daemonset.replicas.available", "kubernetes.daemonset.replicas.desired", "kubernetes.daemonset.replicas.ready", "kubernetes.daemonset.replicas.unavailable", "kubernetes.deployment.name", "kubernetes.deployment.paused", "kubernetes.deployment.replicas.available", "kubernetes.deployment.replicas.desired", "kubernetes.deployment.replicas.unavailable", "kubernetes.deployment.replicas.updated", "kubernetes.event.count", "kubernetes.event.involved_object.api_version", "kubernetes.event.involved_object.kind", "kubernetes.event.involved_object.name", "kubernetes.event.involved_object.resource_version", "kubernetes.event.involved_object.uid", "kubernetes.event.message", "kubernetes.event.metadata.generate_name", "kubernetes.event.metadata.name", "kubernetes.event.metadata.namespace", "kubernetes.event.metadata.resource_version", "kubernetes.event.metadata.self_link", "kubernetes.event.metadata.timestamp.created", "kubernetes.event.metadata.uid", "kubernetes.event.reason", "kubernetes.event.source.component", "kubernetes.event.source.host", "kubernetes.event.timestamp.first_occurrence", "kubernetes.event.timestamp.last_occurrence", "kubernetes.event.type", "kubernetes.namespace", "kubernetes.node.cpu.allocatable.cores", "kubernetes.node.cpu.capacity.cores", "kubernetes.node.cpu.usage.core.ns", "kubernetes.node.cpu.usage.nanocores", "kubernetes.node.fs.available.bytes", "kubernetes.node.fs.capacity.bytes", "kubernetes.node.fs.inodes.count", "kubernetes.node.fs.inodes.free", "kubernetes.node.fs.inodes.used", "kubernetes.node.fs.used.bytes", "kubernetes.node.hostname", "kubernetes.node.memory.allocatable.bytes", "kubernetes.node.memory.available.bytes", "kubernetes.node.memory.capacity.bytes", "kubernetes.node.memory.majorpagefaults", "kubernetes.node.memory.pagefaults", "kubernetes.node.memory.rss.bytes", "kubernetes.node.memory.usage.bytes", "kubernetes.node.memory.workingset.bytes", "kubernetes.node.name", "kubernetes.node.network.rx.bytes", "kubernetes.node.network.rx.errors", "kubernetes.node.network.tx.bytes", "kubernetes.node.network.tx.errors", "kubernetes.node.pod.allocatable.total", "kubernetes.node.pod.capacity.total", "kubernetes.node.runtime.imagefs.available.bytes", "kubernetes.node.runtime.imagefs.capacity.bytes", "kubernetes.node.runtime.imagefs.used.bytes", "kubernetes.node.start_time", "kubernetes.node.status.ready", "kubernetes.node.status.unschedulable", "kubernetes.persistentvolume.capacity.bytes", "kubernetes.persistentvolume.name", "kubernetes.persistentvolume.phase", "kubernetes.persistentvolume.storage_class", "kubernetes.persistentvolumeclaim.access_mode", "kubernetes.persistentvolumeclaim.name", "kubernetes.persistentvolumeclaim.phase", "kubernetes.persistentvolumeclaim.request_storage.bytes", "kubernetes.persistentvolumeclaim.storage_class", "kubernetes.persistentvolumeclaim.volume_name", "kubernetes.pod.cpu.usage.limit.pct", "kubernetes.pod.cpu.usage.nanocores", "kubernetes.pod.cpu.usage.node.pct", "kubernetes.pod.host_ip", "kubernetes.pod.ip", "kubernetes.pod.memory.available.bytes", "kubernetes.pod.memory.major_page_faults", "kubernetes.pod.memory.page_faults", "kubernetes.pod.memory.rss.bytes", "kubernetes.pod.memory.usage.bytes", "kubernetes.pod.memory.usage.limit.pct", "kubernetes.pod.memory.usage.node.pct", "kubernetes.pod.memory.working_set.bytes", "kubernetes.pod.name", "kubernetes.pod.network.rx.bytes", "kubernetes.pod.network.rx.errors", "kubernetes.pod.network.tx.bytes", "kubernetes.pod.network.tx.errors", "kubernetes.pod.start_time", "kubernetes.pod.status.phase", "kubernetes.pod.status.ready", "kubernetes.pod.status.scheduled", "kubernetes.pod.uid", "kubernetes.proxy.client.request.count", "kubernetes.proxy.code", "kubernetes.proxy.handler", "kubernetes.proxy.host", "kubernetes.proxy.http.request.count", "kubernetes.proxy.http.request.duration.us.count", "kubernetes.proxy.http.request.duration.us.sum", "kubernetes.proxy.http.request.size.bytes.count", "kubernetes.proxy.http.request.size.bytes.sum", "kubernetes.proxy.http.response.size.bytes.count", "kubernetes.proxy.http.response.size.bytes.sum", "kubernetes.proxy.method", "kubernetes.proxy.process.cpu.sec", "kubernetes.proxy.process.fds.open.count", "kubernetes.proxy.process.memory.resident.bytes", "kubernetes.proxy.process.memory.virtual.bytes", "kubernetes.proxy.process.started.sec", "kubernetes.proxy.sync.networkprogramming.duration.us.count", "kubernetes.proxy.sync.networkprogramming.duration.us.sum", "kubernetes.proxy.sync.rules.duration.us.count", "kubernetes.proxy.sync.rules.duration.us.sum", "kubernetes.replicaset.name", "kubernetes.replicaset.replicas.available", "kubernetes.replicaset.replicas.desired", "kubernetes.replicaset.replicas.labeled", "kubernetes.replicaset.replicas.observed", "kubernetes.replicaset.replicas.ready", "kubernetes.resourcequota.created.sec", "kubernetes.resourcequota.name", "kubernetes.resourcequota.quota", "kubernetes.resourcequota.resource", "kubernetes.resourcequota.type", "kubernetes.scheduler.client.request.count", "kubernetes.scheduler.code", "kubernetes.scheduler.handler", "kubernetes.scheduler.host", "kubernetes.scheduler.http.request.count", "kubernetes.scheduler.http.request.duration.us.count", "kubernetes.scheduler.http.request.duration.us.sum", "kubernetes.scheduler.http.request.size.bytes.count", "kubernetes.scheduler.http.request.size.bytes.sum", "kubernetes.scheduler.http.response.size.bytes.count", "kubernetes.scheduler.http.response.size.bytes.sum", "kubernetes.scheduler.leader.is_master", "kubernetes.scheduler.method", "kubernetes.scheduler.name", "kubernetes.scheduler.operation", "kubernetes.scheduler.process.cpu.sec", "kubernetes.scheduler.process.fds.open.count", "kubernetes.scheduler.process.memory.resident.bytes", "kubernetes.scheduler.process.memory.virtual.bytes", "kubernetes.scheduler.process.started.sec", "kubernetes.scheduler.result", "kubernetes.scheduler.scheduling.duration.seconds.count", "kubernetes.scheduler.scheduling.duration.seconds.sum", "kubernetes.scheduler.scheduling.e2e.duration.us.count", "kubernetes.scheduler.scheduling.e2e.duration.us.sum", "kubernetes.scheduler.scheduling.pod.attempts.count", "kubernetes.scheduler.scheduling.pod.preemption.victims.bucket.*", "kubernetes.scheduler.scheduling.pod.preemption.victims.count", "kubernetes.scheduler.scheduling.pod.preemption.victims.sum", "kubernetes.service.cluster_ip", "kubernetes.service.created", "kubernetes.service.external_ip", "kubernetes.service.external_name", "kubernetes.service.ingress_hostname", "kubernetes.service.ingress_ip", "kubernetes.service.load_balancer_ip", "kubernetes.service.name", "kubernetes.service.type", "kubernetes.statefulset.created", "kubernetes.statefulset.generation.desired", "kubernetes.statefulset.generation.observed", "kubernetes.statefulset.name", "kubernetes.statefulset.replicas.desired", "kubernetes.statefulset.replicas.observed", "kubernetes.storageclass.created", "kubernetes.storageclass.name", "kubernetes.storageclass.provisioner", "kubernetes.storageclass.reclaim_policy", "kubernetes.storageclass.volume_binding_mode", "kubernetes.system.container", "kubernetes.system.cpu.usage.core.ns", "kubernetes.system.cpu.usage.nanocores", "kubernetes.system.memory.majorpagefaults", "kubernetes.system.memory.pagefaults", "kubernetes.system.memory.rss.bytes", "kubernetes.system.memory.usage.bytes", "kubernetes.system.memory.workingset.bytes", "kubernetes.system.start_time", "kubernetes.volume.fs.available.bytes", "kubernetes.volume.fs.capacity.bytes", "kubernetes.volume.fs.inodes.count", "kubernetes.volume.fs.inodes.free", "kubernetes.volume.fs.inodes.used", "kubernetes.volume.fs.used.bytes", "kubernetes.volume.name", "kvm.dommemstat.id", "kvm.dommemstat.name", "kvm.dommemstat.stat.name", "kvm.dommemstat.stat.value", "kvm.id", "kvm.name", "kvm.status.state", "linux.conntrack.summary.drop", "linux.conntrack.summary.early_drop", "linux.conntrack.summary.entries", "linux.conntrack.summary.found", "linux.conntrack.summary.ignore", "linux.conntrack.summary.insert_failed", "linux.conntrack.summary.invalid", "linux.conntrack.summary.search_restart", "linux.iostat.await", "linux.iostat.busy", "linux.iostat.queue.avg_size", "linux.iostat.read.await", "linux.iostat.read.per_sec.bytes", "linux.iostat.read.request.merges_per_sec", "linux.iostat.read.request.per_sec", "linux.iostat.request.avg_size", "linux.iostat.service_time", "linux.iostat.write.await", "linux.iostat.write.per_sec.bytes", "linux.iostat.write.request.merges_per_sec", "linux.iostat.write.request.per_sec", "linux.ksm.stats.full_scans", "linux.ksm.stats.pages_shared", "linux.ksm.stats.pages_sharing", "linux.ksm.stats.pages_unshared", "linux.ksm.stats.stable_node_chains", "linux.ksm.stats.stable_node_dups", "linux.memory.hugepages.default_size", "linux.memory.hugepages.free", "linux.memory.hugepages.reserved", "linux.memory.hugepages.surplus", "linux.memory.hugepages.total", "linux.memory.hugepages.used.bytes", "linux.memory.hugepages.used.pct", "linux.memory.page_stats.direct_efficiency.pct", "linux.memory.page_stats.kswapd_efficiency.pct", "linux.memory.page_stats.pgfree.pages", "linux.memory.page_stats.pgscan_direct.pages", "linux.memory.page_stats.pgscan_kswapd.pages", "linux.memory.page_stats.pgsteal_direct.pages", "linux.memory.page_stats.pgsteal_kswapd.pages", "linux.pageinfo.buddy_info.DMA.0", "linux.pageinfo.buddy_info.DMA.1", "linux.pageinfo.buddy_info.DMA.10", "linux.pageinfo.buddy_info.DMA.2", "linux.pageinfo.buddy_info.DMA.3", "linux.pageinfo.buddy_info.DMA.4", "linux.pageinfo.buddy_info.DMA.5", "linux.pageinfo.buddy_info.DMA.6", "linux.pageinfo.buddy_info.DMA.7", "linux.pageinfo.buddy_info.DMA.8", "linux.pageinfo.buddy_info.DMA.9", "log.file.path", "log.level", "log.logger", "log.origin.file.line", "log.origin.file.name", "log.origin.function", "log.original", "log.syslog.facility.code", "log.syslog.facility.name", "log.syslog.priority", "log.syslog.severity.code", "log.syslog.severity.name", "logstash.node.jvm.version", "logstash.node.stats.events.filtered", "logstash.node.stats.events.in", "logstash.node.stats.events.out", "memcache.protocol_type", "memcache.request.automove", "memcache.request.bytes", "memcache.request.cas_unique", "memcache.request.command", "memcache.request.count_values", "memcache.request.delta", "memcache.request.dest_class", "memcache.request.exptime", "memcache.request.flags", "memcache.request.initial", "memcache.request.line", "memcache.request.noreply", "memcache.request.opaque", "memcache.request.opcode", "memcache.request.opcode_value", "memcache.request.quiet", "memcache.request.raw_args", "memcache.request.sleep_us", "memcache.request.source_class", "memcache.request.type", "memcache.request.vbucket", "memcache.request.verbosity", "memcache.response.bytes", "memcache.response.cas_unique", "memcache.response.command", "memcache.response.count_values", "memcache.response.error_msg", "memcache.response.flags", "memcache.response.opaque", "memcache.response.opcode", "memcache.response.opcode_value", "memcache.response.status", "memcache.response.status_code", "memcache.response.type", "memcache.response.value", "memcache.response.version", "memcached.stats.bytes.current", "memcached.stats.bytes.limit", "memcached.stats.cmd.get", "memcached.stats.cmd.set", "memcached.stats.connections.current", "memcached.stats.connections.total", "memcached.stats.evictions", "memcached.stats.get.hits", "memcached.stats.get.misses", "memcached.stats.items.current", "memcached.stats.items.total", "memcached.stats.pid", "memcached.stats.read.bytes", "memcached.stats.threads", "memcached.stats.uptime.sec", "memcached.stats.written.bytes", "message", "method", "metricset.name", "metricset.period", "mongodb.collstats.collection", "mongodb.collstats.commands.count", "mongodb.collstats.commands.time.us", "mongodb.collstats.db", "mongodb.collstats.getmore.count", "mongodb.collstats.getmore.time.us", "mongodb.collstats.insert.count", "mongodb.collstats.insert.time.us", "mongodb.collstats.lock.read.count", "mongodb.collstats.lock.read.time.us", "mongodb.collstats.lock.write.count", "mongodb.collstats.lock.write.time.us", "mongodb.collstats.name", "mongodb.collstats.queries.count", "mongodb.collstats.queries.time.us", "mongodb.collstats.remove.count", "mongodb.collstats.remove.time.us", "mongodb.collstats.total.count", "mongodb.collstats.total.time.us", "mongodb.collstats.update.count", "mongodb.collstats.update.time.us", "mongodb.cursorId", "mongodb.dbstats.avg_obj_size.bytes", "mongodb.dbstats.collections", "mongodb.dbstats.data_file_version.major", "mongodb.dbstats.data_file_version.minor", "mongodb.dbstats.data_size.bytes", "mongodb.dbstats.db", "mongodb.dbstats.extent_free_list.num", "mongodb.dbstats.extent_free_list.size.bytes", "mongodb.dbstats.file_size.bytes", "mongodb.dbstats.index_size.bytes", "mongodb.dbstats.indexes", "mongodb.dbstats.ns_size_mb.mb", "mongodb.dbstats.num_extents", "mongodb.dbstats.objects", "mongodb.dbstats.storage_size.bytes", "mongodb.error", "mongodb.fullCollectionName", "mongodb.metrics.commands.aggregate.failed", "mongodb.metrics.commands.aggregate.total", "mongodb.metrics.commands.build_info.failed", "mongodb.metrics.commands.build_info.total", "mongodb.metrics.commands.coll_stats.failed", "mongodb.metrics.commands.coll_stats.total", "mongodb.metrics.commands.connection_pool_stats.failed", "mongodb.metrics.commands.connection_pool_stats.total", "mongodb.metrics.commands.count.failed", "mongodb.metrics.commands.count.total", "mongodb.metrics.commands.db_stats.failed", "mongodb.metrics.commands.db_stats.total", "mongodb.metrics.commands.distinct.failed", "mongodb.metrics.commands.distinct.total", "mongodb.metrics.commands.find.failed", "mongodb.metrics.commands.find.total", "mongodb.metrics.commands.get_cmd_line_opts.failed", "mongodb.metrics.commands.get_cmd_line_opts.total", "mongodb.metrics.commands.get_last_error.failed", "mongodb.metrics.commands.get_last_error.total", "mongodb.metrics.commands.get_log.failed", "mongodb.metrics.commands.get_log.total", "mongodb.metrics.commands.get_more.failed", "mongodb.metrics.commands.get_more.total", "mongodb.metrics.commands.get_parameter.failed", "mongodb.metrics.commands.get_parameter.total", "mongodb.metrics.commands.host_info.failed", "mongodb.metrics.commands.host_info.total", "mongodb.metrics.commands.insert.failed", "mongodb.metrics.commands.insert.total", "mongodb.metrics.commands.is_master.failed", "mongodb.metrics.commands.is_master.total", "mongodb.metrics.commands.is_self.failed", "mongodb.metrics.commands.is_self.total", "mongodb.metrics.commands.last_collections.failed", "mongodb.metrics.commands.last_collections.total", "mongodb.metrics.commands.last_commands.failed", "mongodb.metrics.commands.last_commands.total", "mongodb.metrics.commands.list_databased.failed", "mongodb.metrics.commands.list_databased.total", "mongodb.metrics.commands.list_indexes.failed", "mongodb.metrics.commands.list_indexes.total", "mongodb.metrics.commands.ping.failed", "mongodb.metrics.commands.ping.total", "mongodb.metrics.commands.profile.failed", "mongodb.metrics.commands.profile.total", "mongodb.metrics.commands.replset_get_rbid.failed", "mongodb.metrics.commands.replset_get_rbid.total", "mongodb.metrics.commands.replset_get_status.failed", "mongodb.metrics.commands.replset_get_status.total", "mongodb.metrics.commands.replset_heartbeat.failed", "mongodb.metrics.commands.replset_heartbeat.total", "mongodb.metrics.commands.replset_update_position.failed", "mongodb.metrics.commands.replset_update_position.total", "mongodb.metrics.commands.server_status.failed", "mongodb.metrics.commands.server_status.total", "mongodb.metrics.commands.update.failed", "mongodb.metrics.commands.update.total", "mongodb.metrics.commands.whatsmyuri.failed", "mongodb.metrics.commands.whatsmyuri.total", "mongodb.metrics.cursor.open.no_timeout", "mongodb.metrics.cursor.open.pinned", "mongodb.metrics.cursor.open.total", "mongodb.metrics.cursor.timed_out", "mongodb.metrics.document.deleted", "mongodb.metrics.document.inserted", "mongodb.metrics.document.returned", "mongodb.metrics.document.updated", "mongodb.metrics.get_last_error.write_timeouts", "mongodb.metrics.get_last_error.write_wait.count", "mongodb.metrics.get_last_error.write_wait.ms", "mongodb.metrics.operation.scan_and_order", "mongodb.metrics.operation.write_conflicts", "mongodb.metrics.query_executor.scanned_documents.count", "mongodb.metrics.query_executor.scanned_indexes.count", "mongodb.metrics.replication.apply.attempts_to_become_secondary", "mongodb.metrics.replication.apply.batches.count", "mongodb.metrics.replication.apply.batches.time.ms", "mongodb.metrics.replication.apply.ops", "mongodb.metrics.replication.buffer.count", "mongodb.metrics.replication.buffer.max_size.bytes", "mongodb.metrics.replication.buffer.size.bytes", "mongodb.metrics.replication.executor.counters.cancels", "mongodb.metrics.replication.executor.counters.event_created", "mongodb.metrics.replication.executor.counters.event_wait", "mongodb.metrics.replication.executor.counters.scheduled.dbwork", "mongodb.metrics.replication.executor.counters.scheduled.exclusive", "mongodb.metrics.replication.executor.counters.scheduled.failures", "mongodb.metrics.replication.executor.counters.scheduled.netcmd", "mongodb.metrics.replication.executor.counters.scheduled.work", "mongodb.metrics.replication.executor.counters.scheduled.work_at", "mongodb.metrics.replication.executor.counters.waits", "mongodb.metrics.replication.executor.event_waiters", "mongodb.metrics.replication.executor.network_interface", "mongodb.metrics.replication.executor.queues.free", "mongodb.metrics.replication.executor.queues.in_progress.dbwork", "mongodb.metrics.replication.executor.queues.in_progress.exclusive", "mongodb.metrics.replication.executor.queues.in_progress.network", "mongodb.metrics.replication.executor.queues.ready", "mongodb.metrics.replication.executor.queues.sleepers", "mongodb.metrics.replication.executor.shutting_down", "mongodb.metrics.replication.executor.unsignaled_events", "mongodb.metrics.replication.initial_sync.completed", "mongodb.metrics.replication.initial_sync.failed_attempts", "mongodb.metrics.replication.initial_sync.failures", "mongodb.metrics.replication.network.bytes", "mongodb.metrics.replication.network.getmores.count", "mongodb.metrics.replication.network.getmores.time.ms", "mongodb.metrics.replication.network.ops", "mongodb.metrics.replication.network.reders_created", "mongodb.metrics.replication.preload.docs.count", "mongodb.metrics.replication.preload.docs.time.ms", "mongodb.metrics.replication.preload.indexes.count", "mongodb.metrics.replication.preload.indexes.time.ms", "mongodb.metrics.storage.free_list.search.bucket_exhausted", "mongodb.metrics.storage.free_list.search.requests", "mongodb.metrics.storage.free_list.search.scanned", "mongodb.metrics.ttl.deleted_documents.count", "mongodb.metrics.ttl.passes.count", "mongodb.numberReturned", "mongodb.numberToReturn", "mongodb.numberToSkip", "mongodb.query", "mongodb.replstatus.headroom.max", "mongodb.replstatus.headroom.min", "mongodb.replstatus.lag.max", "mongodb.replstatus.lag.min", "mongodb.replstatus.members.arbiter.count", "mongodb.replstatus.members.arbiter.hosts", "mongodb.replstatus.members.down.count", "mongodb.replstatus.members.down.hosts", "mongodb.replstatus.members.primary.host", "mongodb.replstatus.members.primary.optime", "mongodb.replstatus.members.recovering.count", "mongodb.replstatus.members.recovering.hosts", "mongodb.replstatus.members.rollback.count", "mongodb.replstatus.members.rollback.hosts", "mongodb.replstatus.members.secondary.count", "mongodb.replstatus.members.secondary.hosts", "mongodb.replstatus.members.secondary.optimes", "mongodb.replstatus.members.startup2.count", "mongodb.replstatus.members.startup2.hosts", "mongodb.replstatus.members.unhealthy.count", "mongodb.replstatus.members.unhealthy.hosts", "mongodb.replstatus.members.unknown.count", "mongodb.replstatus.members.unknown.hosts", "mongodb.replstatus.oplog.first.timestamp", "mongodb.replstatus.oplog.last.timestamp", "mongodb.replstatus.oplog.size.allocated", "mongodb.replstatus.oplog.size.used", "mongodb.replstatus.oplog.window", "mongodb.replstatus.optimes.applied", "mongodb.replstatus.optimes.durable", "mongodb.replstatus.optimes.last_committed", "mongodb.replstatus.server_date", "mongodb.replstatus.set_name", "mongodb.returnFieldsSelector", "mongodb.selector", "mongodb.startingFrom", "mongodb.status.asserts.msg", "mongodb.status.asserts.regular", "mongodb.status.asserts.rollovers", "mongodb.status.asserts.user", "mongodb.status.asserts.warning", "mongodb.status.background_flushing.average.ms", "mongodb.status.background_flushing.flushes", "mongodb.status.background_flushing.last.ms", "mongodb.status.background_flushing.last_finished", "mongodb.status.background_flushing.total.ms", "mongodb.status.connections.available", "mongodb.status.connections.current", "mongodb.status.connections.total_created", "mongodb.status.extra_info.heap_usage.bytes", "mongodb.status.extra_info.page_faults", "mongodb.status.global_lock.active_clients.readers", "mongodb.status.global_lock.active_clients.total", "mongodb.status.global_lock.active_clients.writers", "mongodb.status.global_lock.current_queue.readers", "mongodb.status.global_lock.current_queue.total", "mongodb.status.global_lock.current_queue.writers", "mongodb.status.global_lock.total_time.us", "mongodb.status.journaling.commits", "mongodb.status.journaling.commits_in_write_lock", "mongodb.status.journaling.compression", "mongodb.status.journaling.early_commits", "mongodb.status.journaling.journaled.mb", "mongodb.status.journaling.times.commits.ms", "mongodb.status.journaling.times.commits_in_write_lock.ms", "mongodb.status.journaling.times.dt.ms", "mongodb.status.journaling.times.prep_log_buffer.ms", "mongodb.status.journaling.times.remap_private_view.ms", "mongodb.status.journaling.times.write_to_data_files.ms", "mongodb.status.journaling.times.write_to_journal.ms", "mongodb.status.journaling.write_to_data_files.mb", "mongodb.status.local_time", "mongodb.status.locks.collection.acquire.count.R", "mongodb.status.locks.collection.acquire.count.W", "mongodb.status.locks.collection.acquire.count.r", "mongodb.status.locks.collection.acquire.count.w", "mongodb.status.locks.collection.deadlock.count.R", "mongodb.status.locks.collection.deadlock.count.W", "mongodb.status.locks.collection.deadlock.count.r", "mongodb.status.locks.collection.deadlock.count.w", "mongodb.status.locks.collection.wait.count.R", "mongodb.status.locks.collection.wait.count.W", "mongodb.status.locks.collection.wait.count.r", "mongodb.status.locks.collection.wait.count.w", "mongodb.status.locks.collection.wait.us.R", "mongodb.status.locks.collection.wait.us.W", "mongodb.status.locks.collection.wait.us.r", "mongodb.status.locks.collection.wait.us.w", "mongodb.status.locks.database.acquire.count.R", "mongodb.status.locks.database.acquire.count.W", "mongodb.status.locks.database.acquire.count.r", "mongodb.status.locks.database.acquire.count.w", "mongodb.status.locks.database.deadlock.count.R", "mongodb.status.locks.database.deadlock.count.W", "mongodb.status.locks.database.deadlock.count.r", "mongodb.status.locks.database.deadlock.count.w", "mongodb.status.locks.database.wait.count.R", "mongodb.status.locks.database.wait.count.W", "mongodb.status.locks.database.wait.count.r", "mongodb.status.locks.database.wait.count.w", "mongodb.status.locks.database.wait.us.R", "mongodb.status.locks.database.wait.us.W", "mongodb.status.locks.database.wait.us.r", "mongodb.status.locks.database.wait.us.w", "mongodb.status.locks.global.acquire.count.R", "mongodb.status.locks.global.acquire.count.W", "mongodb.status.locks.global.acquire.count.r", "mongodb.status.locks.global.acquire.count.w", "mongodb.status.locks.global.deadlock.count.R", "mongodb.status.locks.global.deadlock.count.W", "mongodb.status.locks.global.deadlock.count.r", "mongodb.status.locks.global.deadlock.count.w", "mongodb.status.locks.global.wait.count.R", "mongodb.status.locks.global.wait.count.W", "mongodb.status.locks.global.wait.count.r", "mongodb.status.locks.global.wait.count.w", "mongodb.status.locks.global.wait.us.R", "mongodb.status.locks.global.wait.us.W", "mongodb.status.locks.global.wait.us.r", "mongodb.status.locks.global.wait.us.w", "mongodb.status.locks.meta_data.acquire.count.R", "mongodb.status.locks.meta_data.acquire.count.W", "mongodb.status.locks.meta_data.acquire.count.r", "mongodb.status.locks.meta_data.acquire.count.w", "mongodb.status.locks.meta_data.deadlock.count.R", "mongodb.status.locks.meta_data.deadlock.count.W", "mongodb.status.locks.meta_data.deadlock.count.r", "mongodb.status.locks.meta_data.deadlock.count.w", "mongodb.status.locks.meta_data.wait.count.R", "mongodb.status.locks.meta_data.wait.count.W", "mongodb.status.locks.meta_data.wait.count.r", "mongodb.status.locks.meta_data.wait.count.w", "mongodb.status.locks.meta_data.wait.us.R", "mongodb.status.locks.meta_data.wait.us.W", "mongodb.status.locks.meta_data.wait.us.r", "mongodb.status.locks.meta_data.wait.us.w", "mongodb.status.locks.oplog.acquire.count.R", "mongodb.status.locks.oplog.acquire.count.W", "mongodb.status.locks.oplog.acquire.count.r", "mongodb.status.locks.oplog.acquire.count.w", "mongodb.status.locks.oplog.deadlock.count.R", "mongodb.status.locks.oplog.deadlock.count.W", "mongodb.status.locks.oplog.deadlock.count.r", "mongodb.status.locks.oplog.deadlock.count.w", "mongodb.status.locks.oplog.wait.count.R", "mongodb.status.locks.oplog.wait.count.W", "mongodb.status.locks.oplog.wait.count.r", "mongodb.status.locks.oplog.wait.count.w", "mongodb.status.locks.oplog.wait.us.R", "mongodb.status.locks.oplog.wait.us.W", "mongodb.status.locks.oplog.wait.us.r", "mongodb.status.locks.oplog.wait.us.w", "mongodb.status.memory.bits", "mongodb.status.memory.mapped.mb", "mongodb.status.memory.mapped_with_journal.mb", "mongodb.status.memory.resident.mb", "mongodb.status.memory.virtual.mb", "mongodb.status.network.in.bytes", "mongodb.status.network.out.bytes", "mongodb.status.network.requests", "mongodb.status.ops.counters.command", "mongodb.status.ops.counters.delete", "mongodb.status.ops.counters.getmore", "mongodb.status.ops.counters.insert", "mongodb.status.ops.counters.query", "mongodb.status.ops.counters.update", "mongodb.status.ops.latencies.commands.count", "mongodb.status.ops.latencies.commands.latency", "mongodb.status.ops.latencies.reads.count", "mongodb.status.ops.latencies.reads.latency", "mongodb.status.ops.latencies.writes.count", "mongodb.status.ops.latencies.writes.latency", "mongodb.status.ops.replicated.command", "mongodb.status.ops.replicated.delete", "mongodb.status.ops.replicated.getmore", "mongodb.status.ops.replicated.insert", "mongodb.status.ops.replicated.query", "mongodb.status.ops.replicated.update", "mongodb.status.process", "mongodb.status.storage_engine.name", "mongodb.status.uptime.ms", "mongodb.status.version", "mongodb.status.wired_tiger.cache.dirty.bytes", "mongodb.status.wired_tiger.cache.maximum.bytes", "mongodb.status.wired_tiger.cache.pages.evicted", "mongodb.status.wired_tiger.cache.pages.read", "mongodb.status.wired_tiger.cache.pages.write", "mongodb.status.wired_tiger.cache.used.bytes", "mongodb.status.wired_tiger.concurrent_transactions.read.available", "mongodb.status.wired_tiger.concurrent_transactions.read.out", "mongodb.status.wired_tiger.concurrent_transactions.read.total_tickets", "mongodb.status.wired_tiger.concurrent_transactions.write.available", "mongodb.status.wired_tiger.concurrent_transactions.write.out", "mongodb.status.wired_tiger.concurrent_transactions.write.total_tickets", "mongodb.status.wired_tiger.log.flushes", "mongodb.status.wired_tiger.log.max_file_size.bytes", "mongodb.status.wired_tiger.log.scans", "mongodb.status.wired_tiger.log.size.bytes", "mongodb.status.wired_tiger.log.syncs", "mongodb.status.wired_tiger.log.write.bytes", "mongodb.status.wired_tiger.log.writes", "mongodb.status.write_backs_queued", "mongodb.update", "munin.plugin.name", "mysql.affected_rows", "mysql.error_code", "mysql.error_message", "mysql.galera_status.apply.oooe", "mysql.galera_status.apply.oool", "mysql.galera_status.apply.window", "mysql.galera_status.cert.deps_distance", "mysql.galera_status.cert.index_size", "mysql.galera_status.cert.interval", "mysql.galera_status.cluster.conf_id", "mysql.galera_status.cluster.size", "mysql.galera_status.cluster.status", "mysql.galera_status.commit.oooe", "mysql.galera_status.commit.window", "mysql.galera_status.connected", "mysql.galera_status.evs.evict", "mysql.galera_status.evs.state", "mysql.galera_status.flow_ctl.paused", "mysql.galera_status.flow_ctl.paused_ns", "mysql.galera_status.flow_ctl.recv", "mysql.galera_status.flow_ctl.sent", "mysql.galera_status.last_committed", "mysql.galera_status.local.bf_aborts", "mysql.galera_status.local.cert_failures", "mysql.galera_status.local.commits", "mysql.galera_status.local.recv.queue", "mysql.galera_status.local.recv.queue_avg", "mysql.galera_status.local.recv.queue_max", "mysql.galera_status.local.recv.queue_min", "mysql.galera_status.local.replays", "mysql.galera_status.local.send.queue", "mysql.galera_status.local.send.queue_avg", "mysql.galera_status.local.send.queue_max", "mysql.galera_status.local.send.queue_min", "mysql.galera_status.local.state", "mysql.galera_status.ready", "mysql.galera_status.received.bytes", "mysql.galera_status.received.count", "mysql.galera_status.repl.bytes", "mysql.galera_status.repl.count", "mysql.galera_status.repl.data_bytes", "mysql.galera_status.repl.keys", "mysql.galera_status.repl.keys_bytes", "mysql.galera_status.repl.other_bytes", "mysql.insert_id", "mysql.num_fields", "mysql.num_rows", "mysql.performance.events_statements.avg.timer.wait", "mysql.performance.events_statements.count.star", "mysql.performance.events_statements.digest", "mysql.performance.events_statements.last.seen", "mysql.performance.events_statements.max.timer.wait", "mysql.performance.events_statements.quantile.95", "mysql.performance.table_io_waits.count.fetch", "mysql.performance.table_io_waits.index.name", "mysql.performance.table_io_waits.object.name", "mysql.performance.table_io_waits.object.schema", "mysql.query", "mysql.status.aborted.clients", "mysql.status.aborted.connects", "mysql.status.binlog.cache.disk_use", "mysql.status.binlog.cache.use", "mysql.status.bytes.received", "mysql.status.bytes.sent", "mysql.status.cache.ssl.hits", "mysql.status.cache.ssl.misses", "mysql.status.cache.ssl.size", "mysql.status.cache.table.open_cache.hits", "mysql.status.cache.table.open_cache.misses", "mysql.status.cache.table.open_cache.overflows", "mysql.status.command.delete", "mysql.status.command.insert", "mysql.status.command.select", "mysql.status.command.update", "mysql.status.connection.errors.accept", "mysql.status.connection.errors.internal", "mysql.status.connection.errors.max", "mysql.status.connection.errors.peer_address", "mysql.status.connection.errors.select", "mysql.status.connection.errors.tcpwrap", "mysql.status.connections", "mysql.status.created.tmp.disk_tables", "mysql.status.created.tmp.files", "mysql.status.created.tmp.tables", "mysql.status.delayed.errors", "mysql.status.delayed.insert_threads", "mysql.status.delayed.writes", "mysql.status.flush_commands", "mysql.status.handler.commit", "mysql.status.handler.delete", "mysql.status.handler.external_lock", "mysql.status.handler.mrr_init", "mysql.status.handler.prepare", "mysql.status.handler.read.first", "mysql.status.handler.read.key", "mysql.status.handler.read.last", "mysql.status.handler.read.next", "mysql.status.handler.read.prev", "mysql.status.handler.read.rnd", "mysql.status.handler.read.rnd_next", "mysql.status.handler.rollback", "mysql.status.handler.savepoint", "mysql.status.handler.savepoint_rollback", "mysql.status.handler.update", "mysql.status.handler.write", "mysql.status.innodb.buffer_pool.bytes.data", "mysql.status.innodb.buffer_pool.bytes.dirty", "mysql.status.innodb.buffer_pool.dump_status", "mysql.status.innodb.buffer_pool.load_status", "mysql.status.innodb.buffer_pool.pages.data", "mysql.status.innodb.buffer_pool.pages.dirty", "mysql.status.innodb.buffer_pool.pages.flushed", "mysql.status.innodb.buffer_pool.pages.free", "mysql.status.innodb.buffer_pool.pages.latched", "mysql.status.innodb.buffer_pool.pages.misc", "mysql.status.innodb.buffer_pool.pages.total", "mysql.status.innodb.buffer_pool.pool.reads", "mysql.status.innodb.buffer_pool.pool.resize_status", "mysql.status.innodb.buffer_pool.pool.wait_free", "mysql.status.innodb.buffer_pool.read.ahead", "mysql.status.innodb.buffer_pool.read.ahead_evicted", "mysql.status.innodb.buffer_pool.read.ahead_rnd", "mysql.status.innodb.buffer_pool.read.requests", "mysql.status.innodb.buffer_pool.write_requests", "mysql.status.innodb.rows.deleted", "mysql.status.innodb.rows.inserted", "mysql.status.innodb.rows.reads", "mysql.status.innodb.rows.updated", "mysql.status.max_used_connections", "mysql.status.open.files", "mysql.status.open.streams", "mysql.status.open.tables", "mysql.status.opened_tables", "mysql.status.queries", "mysql.status.questions", "mysql.status.threads.cached", "mysql.status.threads.connected", "mysql.status.threads.created", "mysql.status.threads.running", "nats.connection.idle_time", "nats.connection.in.bytes", "nats.connection.in.messages", "nats.connection.name", "nats.connection.out.bytes", "nats.connection.out.messages", "nats.connection.pending_bytes", "nats.connection.subscriptions", "nats.connection.uptime", "nats.connections.total", "nats.route.in.bytes", "nats.route.in.messages", "nats.route.ip", "nats.route.out.bytes", "nats.route.out.messages", "nats.route.pending_size", "nats.route.port", "nats.route.remote_id", "nats.route.subscriptions", "nats.routes.total", "nats.server.id", "nats.server.time", "nats.stats.cores", "nats.stats.cpu", "nats.stats.http.req_stats.uri.connz", "nats.stats.http.req_stats.uri.root", "nats.stats.http.req_stats.uri.routez", "nats.stats.http.req_stats.uri.subsz", "nats.stats.http.req_stats.uri.varz", "nats.stats.in.bytes", "nats.stats.in.messages", "nats.stats.mem.bytes", "nats.stats.out.bytes", "nats.stats.out.messages", "nats.stats.remotes", "nats.stats.slow_consumers", "nats.stats.total_connections", "nats.stats.uptime", "nats.subscriptions.cache.fanout.avg", "nats.subscriptions.cache.fanout.max", "nats.subscriptions.cache.hit_rate", "nats.subscriptions.cache.size", "nats.subscriptions.inserts", "nats.subscriptions.matches", "nats.subscriptions.removes", "nats.subscriptions.total", "network.application", "network.bytes", "network.community_id", "network.direction", "network.forwarded_ip", "network.iana_number", "network.inner.vlan.id", "network.inner.vlan.name", "network.name", "network.packets", "network.protocol", "network.transport", "network.type", "network.vlan.id", "network.vlan.name", "nfs.minor_version", "nfs.opcode", "nfs.status", "nfs.tag", "nfs.version", "nginx.stubstatus.accepts", "nginx.stubstatus.active", "nginx.stubstatus.current", "nginx.stubstatus.dropped", "nginx.stubstatus.handled", "nginx.stubstatus.hostname", "nginx.stubstatus.reading", "nginx.stubstatus.requests", "nginx.stubstatus.waiting", "nginx.stubstatus.writing", "notes", "observer.egress.interface.alias", "observer.egress.interface.id", "observer.egress.interface.name", "observer.egress.vlan.id", "observer.egress.vlan.name", "observer.egress.zone", "observer.geo.city_name", "observer.geo.continent_name", "observer.geo.country_iso_code", "observer.geo.country_name", "observer.geo.location", "observer.geo.name", "observer.geo.region_iso_code", "observer.geo.region_name", "observer.hostname", "observer.ingress.interface.alias", "observer.ingress.interface.id", "observer.ingress.interface.name", "observer.ingress.vlan.id", "observer.ingress.vlan.name", "observer.ingress.zone", "observer.ip", "observer.mac", "observer.name", "observer.os.family", "observer.os.full", "observer.os.full.text", "observer.os.kernel", "observer.os.name", "observer.os.name.text", "observer.os.platform", "observer.os.version", "observer.product", "observer.serial_number", "observer.type", "observer.vendor", "observer.version", "organization.id", "organization.name", "organization.name.text", "os.family", "os.full", "os.full.text", "os.kernel", "os.name", "os.name.text", "os.platform", "os.version", "package.architecture", "package.build_version", "package.checksum", "package.description", "package.install_scope", "package.installed", "package.license", "package.name", "package.path", "package.reference", "package.size", "package.type", "package.version", "params", "path", "pe.architecture", "pe.company", "pe.description", "pe.file_version", "pe.imphash", "pe.original_file_name", "pe.product", "pgsql.error_code", "pgsql.error_message", "pgsql.error_severity", "pgsql.num_fields", "pgsql.num_rows", "php_fpm.pool.connections.accepted", "php_fpm.pool.connections.listen_queue_len", "php_fpm.pool.connections.max_listen_queue", "php_fpm.pool.connections.queued", "php_fpm.pool.name", "php_fpm.pool.process_manager", "php_fpm.pool.processes.active", "php_fpm.pool.processes.idle", "php_fpm.pool.processes.max_active", "php_fpm.pool.processes.max_children_reached", "php_fpm.pool.processes.total", "php_fpm.pool.slow_requests", "php_fpm.pool.start_since", "php_fpm.pool.start_time", "php_fpm.process.last_request_cpu", "php_fpm.process.last_request_memory", "php_fpm.process.request_duration", "php_fpm.process.requests", "php_fpm.process.script", "php_fpm.process.start_since", "php_fpm.process.start_time", "php_fpm.process.state", "postgresql.activity.application_name", "postgresql.activity.backend_start", "postgresql.activity.client.address", "postgresql.activity.client.hostname", "postgresql.activity.client.port", "postgresql.activity.database.name", "postgresql.activity.database.oid", "postgresql.activity.pid", "postgresql.activity.query", "postgresql.activity.query_start", "postgresql.activity.state", "postgresql.activity.state_change", "postgresql.activity.transaction_start", "postgresql.activity.user.id", "postgresql.activity.user.name", "postgresql.activity.waiting", "postgresql.bgwriter.buffers.allocated", "postgresql.bgwriter.buffers.backend", "postgresql.bgwriter.buffers.backend_fsync", "postgresql.bgwriter.buffers.checkpoints", "postgresql.bgwriter.buffers.clean", "postgresql.bgwriter.buffers.clean_full", "postgresql.bgwriter.checkpoints.requested", "postgresql.bgwriter.checkpoints.scheduled", "postgresql.bgwriter.checkpoints.times.sync.ms", "postgresql.bgwriter.checkpoints.times.write.ms", "postgresql.bgwriter.stats_reset", "postgresql.database.blocks.hit", "postgresql.database.blocks.read", "postgresql.database.blocks.time.read.ms", "postgresql.database.blocks.time.write.ms", "postgresql.database.conflicts", "postgresql.database.deadlocks", "postgresql.database.name", "postgresql.database.number_of_backends", "postgresql.database.oid", "postgresql.database.rows.deleted", "postgresql.database.rows.fetched", "postgresql.database.rows.inserted", "postgresql.database.rows.returned", "postgresql.database.rows.updated", "postgresql.database.stats_reset", "postgresql.database.temporary.bytes", "postgresql.database.temporary.files", "postgresql.database.transactions.commit", "postgresql.database.transactions.rollback", "postgresql.statement.database.oid", "postgresql.statement.query.calls", "postgresql.statement.query.id", "postgresql.statement.query.memory.local.dirtied", "postgresql.statement.query.memory.local.hit", "postgresql.statement.query.memory.local.read", "postgresql.statement.query.memory.local.written", "postgresql.statement.query.memory.shared.dirtied", "postgresql.statement.query.memory.shared.hit", "postgresql.statement.query.memory.shared.read", "postgresql.statement.query.memory.shared.written", "postgresql.statement.query.memory.temp.read", "postgresql.statement.query.memory.temp.written", "postgresql.statement.query.rows", "postgresql.statement.query.text", "postgresql.statement.query.time.max.ms", "postgresql.statement.query.time.mean.ms", "postgresql.statement.query.time.min.ms", "postgresql.statement.query.time.stddev.ms", "postgresql.statement.query.time.total.ms", "postgresql.statement.user.id", "process.args", "process.args_count", "process.code_signature.exists", "process.code_signature.status", "process.code_signature.subject_name", "process.code_signature.trusted", "process.code_signature.valid", "process.command_line", "process.command_line.text", "process.cpu.pct", "process.cpu.start_time", "process.entity_id", "process.executable", "process.executable.text", "process.exit_code", "process.hash.md5", "process.hash.sha1", "process.hash.sha256", "process.hash.sha512", "process.memory.pct", "process.name", "process.name.text", "process.parent.args", "process.parent.args_count", "process.parent.code_signature.exists", "process.parent.code_signature.status", "process.parent.code_signature.subject_name", "process.parent.code_signature.trusted", "process.parent.code_signature.valid", "process.parent.command_line", "process.parent.command_line.text", "process.parent.entity_id", "process.parent.executable", "process.parent.executable.text", "process.parent.exit_code", "process.parent.hash.md5", "process.parent.hash.sha1", "process.parent.hash.sha256", "process.parent.hash.sha512", "process.parent.name", "process.parent.name.text", "process.parent.pe.architecture", "process.parent.pe.company", "process.parent.pe.description", "process.parent.pe.file_version", "process.parent.pe.imphash", "process.parent.pe.original_file_name", "process.parent.pe.product", "process.parent.pgid", "process.parent.pid", "process.parent.ppid", "process.parent.start", "process.parent.thread.id", "process.parent.thread.name", "process.parent.title", "process.parent.title.text", "process.parent.uptime", "process.parent.working_directory", "process.parent.working_directory.text", "process.pe.architecture", "process.pe.company", "process.pe.description", "process.pe.file_version", "process.pe.imphash", "process.pe.original_file_name", "process.pe.product", "process.pgid", "process.pid", "process.ppid", "process.start", "process.state", "process.thread.id", "process.thread.name", "process.title", "process.title.text", "process.uptime", "process.working_directory", "process.working_directory.text", "query", "rabbitmq.connection.channel_max", "rabbitmq.connection.channels", "rabbitmq.connection.client_provided.name", "rabbitmq.connection.frame_max", "rabbitmq.connection.host", "rabbitmq.connection.name", "rabbitmq.connection.octet_count.received", "rabbitmq.connection.octet_count.sent", "rabbitmq.connection.packet_count.pending", "rabbitmq.connection.packet_count.received", "rabbitmq.connection.packet_count.sent", "rabbitmq.connection.peer.host", "rabbitmq.connection.peer.port", "rabbitmq.connection.port", "rabbitmq.connection.type", "rabbitmq.exchange.auto_delete", "rabbitmq.exchange.durable", "rabbitmq.exchange.internal", "rabbitmq.exchange.messages.publish_in.count", "rabbitmq.exchange.messages.publish_in.details.rate", "rabbitmq.exchange.messages.publish_out.count", "rabbitmq.exchange.messages.publish_out.details.rate", "rabbitmq.exchange.name", "rabbitmq.node.disk.free.bytes", "rabbitmq.node.disk.free.limit.bytes", "rabbitmq.node.fd.total", "rabbitmq.node.fd.used", "rabbitmq.node.gc.num.count", "rabbitmq.node.gc.reclaimed.bytes", "rabbitmq.node.io.file_handle.open_attempt.avg.ms", "rabbitmq.node.io.file_handle.open_attempt.count", "rabbitmq.node.io.read.avg.ms", "rabbitmq.node.io.read.bytes", "rabbitmq.node.io.read.count", "rabbitmq.node.io.reopen.count", "rabbitmq.node.io.seek.avg.ms", "rabbitmq.node.io.seek.count", "rabbitmq.node.io.sync.avg.ms", "rabbitmq.node.io.sync.count", "rabbitmq.node.io.write.avg.ms", "rabbitmq.node.io.write.bytes", "rabbitmq.node.io.write.count", "rabbitmq.node.mem.limit.bytes", "rabbitmq.node.mem.used.bytes", "rabbitmq.node.mnesia.disk.tx.count", "rabbitmq.node.mnesia.ram.tx.count", "rabbitmq.node.msg.store_read.count", "rabbitmq.node.msg.store_write.count", "rabbitmq.node.name", "rabbitmq.node.proc.total", "rabbitmq.node.proc.used", "rabbitmq.node.processors", "rabbitmq.node.queue.index.journal_write.count", "rabbitmq.node.queue.index.read.count", "rabbitmq.node.queue.index.write.count", "rabbitmq.node.run.queue", "rabbitmq.node.socket.total", "rabbitmq.node.socket.used", "rabbitmq.node.type", "rabbitmq.node.uptime", "rabbitmq.queue.arguments.max_priority", "rabbitmq.queue.auto_delete", "rabbitmq.queue.consumers.count", "rabbitmq.queue.consumers.utilisation.pct", "rabbitmq.queue.disk.reads.count", "rabbitmq.queue.disk.writes.count", "rabbitmq.queue.durable", "rabbitmq.queue.exclusive", "rabbitmq.queue.memory.bytes", "rabbitmq.queue.messages.persistent.count", "rabbitmq.queue.messages.ready.count", "rabbitmq.queue.messages.ready.details.rate", "rabbitmq.queue.messages.total.count", "rabbitmq.queue.messages.total.details.rate", "rabbitmq.queue.messages.unacknowledged.count", "rabbitmq.queue.messages.unacknowledged.details.rate", "rabbitmq.queue.name", "rabbitmq.queue.state", "rabbitmq.vhost", "redis.error", "redis.info.clients.biggest_input_buf", "redis.info.clients.blocked", "redis.info.clients.connected", "redis.info.clients.longest_output_list", "redis.info.clients.max_input_buffer", "redis.info.clients.max_output_buffer", "redis.info.cluster.enabled", "redis.info.cpu.used.sys", "redis.info.cpu.used.sys_children", "redis.info.cpu.used.user", "redis.info.cpu.used.user_children", "redis.info.memory.active_defrag.is_running", "redis.info.memory.allocator", "redis.info.memory.allocator_stats.active", "redis.info.memory.allocator_stats.allocated", "redis.info.memory.allocator_stats.fragmentation.bytes", "redis.info.memory.allocator_stats.fragmentation.ratio", "redis.info.memory.allocator_stats.resident", "redis.info.memory.allocator_stats.rss.bytes", "redis.info.memory.allocator_stats.rss.ratio", "redis.info.memory.fragmentation.bytes", "redis.info.memory.fragmentation.ratio", "redis.info.memory.max.policy", "redis.info.memory.max.value", "redis.info.memory.used.dataset", "redis.info.memory.used.lua", "redis.info.memory.used.peak", "redis.info.memory.used.rss", "redis.info.memory.used.value", "redis.info.persistence.aof.bgrewrite.last_status", "redis.info.persistence.aof.buffer.size", "redis.info.persistence.aof.copy_on_write.last_size", "redis.info.persistence.aof.enabled", "redis.info.persistence.aof.fsync.delayed", "redis.info.persistence.aof.fsync.pending", "redis.info.persistence.aof.rewrite.buffer.size", "redis.info.persistence.aof.rewrite.current_time.sec", "redis.info.persistence.aof.rewrite.in_progress", "redis.info.persistence.aof.rewrite.last_time.sec", "redis.info.persistence.aof.rewrite.scheduled", "redis.info.persistence.aof.size.base", "redis.info.persistence.aof.size.current", "redis.info.persistence.aof.write.last_status", "redis.info.persistence.loading", "redis.info.persistence.rdb.bgsave.current_time.sec", "redis.info.persistence.rdb.bgsave.in_progress", "redis.info.persistence.rdb.bgsave.last_status", "redis.info.persistence.rdb.bgsave.last_time.sec", "redis.info.persistence.rdb.copy_on_write.last_size", "redis.info.persistence.rdb.last_save.changes_since", "redis.info.persistence.rdb.last_save.time", "redis.info.replication.backlog.active", "redis.info.replication.backlog.first_byte_offset", "redis.info.replication.backlog.histlen", "redis.info.replication.backlog.size", "redis.info.replication.connected_slaves", "redis.info.replication.master.last_io_seconds_ago", "redis.info.replication.master.link_status", "redis.info.replication.master.offset", "redis.info.replication.master.second_offset", "redis.info.replication.master.sync.in_progress", "redis.info.replication.master.sync.last_io_seconds_ago", "redis.info.replication.master.sync.left_bytes", "redis.info.replication.master_offset", "redis.info.replication.role", "redis.info.replication.slave.is_readonly", "redis.info.replication.slave.offset", "redis.info.replication.slave.priority", "redis.info.server.arch_bits", "redis.info.server.build_id", "redis.info.server.config_file", "redis.info.server.gcc_version", "redis.info.server.git_dirty", "redis.info.server.git_sha1", "redis.info.server.hz", "redis.info.server.lru_clock", "redis.info.server.mode", "redis.info.server.multiplexing_api", "redis.info.server.run_id", "redis.info.server.tcp_port", "redis.info.server.uptime", "redis.info.slowlog.count", "redis.info.stats.active_defrag.hits", "redis.info.stats.active_defrag.key_hits", "redis.info.stats.active_defrag.key_misses", "redis.info.stats.active_defrag.misses", "redis.info.stats.commands_processed", "redis.info.stats.connections.received", "redis.info.stats.connections.rejected", "redis.info.stats.instantaneous.input_kbps", "redis.info.stats.instantaneous.ops_per_sec", "redis.info.stats.instantaneous.output_kbps", "redis.info.stats.keys.evicted", "redis.info.stats.keys.expired", "redis.info.stats.keyspace.hits", "redis.info.stats.keyspace.misses", "redis.info.stats.latest_fork_usec", "redis.info.stats.migrate_cached_sockets", "redis.info.stats.net.input.bytes", "redis.info.stats.net.output.bytes", "redis.info.stats.pubsub.channels", "redis.info.stats.pubsub.patterns", "redis.info.stats.slave_expires_tracked_keys", "redis.info.stats.sync.full", "redis.info.stats.sync.partial.err", "redis.info.stats.sync.partial.ok", "redis.key.expire.ttl", "redis.key.id", "redis.key.length", "redis.key.name", "redis.key.type", "redis.keyspace.avg_ttl", "redis.keyspace.expires", "redis.keyspace.id", "redis.keyspace.keys", "redis.return_value", "registry.data.bytes", "registry.data.strings", "registry.data.type", "registry.hive", "registry.key", "registry.path", "registry.value", "related.hash", "related.hosts", "related.ip", "related.user", "request", "resource", "response", "rpc.auth_flavor", "rpc.cred.gid", "rpc.cred.gids", "rpc.cred.machinename", "rpc.cred.stamp", "rpc.cred.uid", "rpc.status", "rpc.xid", "rule.author", "rule.category", "rule.description", "rule.id", "rule.license", "rule.name", "rule.reference", "rule.ruleset", "rule.uuid", "rule.version", "server.address", "server.as.number", "server.as.organization.name", "server.as.organization.name.text", "server.bytes", "server.domain", "server.geo.city_name", "server.geo.continent_name", "server.geo.country_iso_code", "server.geo.country_name", "server.geo.location", "server.geo.name", "server.geo.region_iso_code", "server.geo.region_name", "server.ip", "server.mac", "server.nat.ip", "server.nat.port", "server.packets", "server.port", "server.process.args", "server.process.executable", "server.process.name", "server.process.start", "server.process.working_directory", "server.registered_domain", "server.subdomain", "server.top_level_domain", "server.user.domain", "server.user.email", "server.user.full_name", "server.user.full_name.text", "server.user.group.domain", "server.user.group.id", "server.user.group.name", "server.user.hash", "server.user.id", "server.user.name", "server.user.name.text", "server.user.roles", "service.address", "service.ephemeral_id", "service.hostname", "service.id", "service.name", "service.node.name", "service.state", "service.type", "service.version", "sip.accept", "sip.allow", "sip.auth.realm", "sip.auth.scheme", "sip.auth.uri.host", "sip.auth.uri.original", "sip.auth.uri.original.text", "sip.auth.uri.port", "sip.auth.uri.scheme", "sip.call_id", "sip.code", "sip.contact.display_info", "sip.contact.expires", "sip.contact.line", "sip.contact.q", "sip.contact.transport", "sip.contact.uri.host", "sip.contact.uri.original", "sip.contact.uri.original.text", "sip.contact.uri.port", "sip.contact.uri.scheme", "sip.contact.uri.username", "sip.content_length", "sip.content_type", "sip.cseq.code", "sip.cseq.method", "sip.from.display_info", "sip.from.tag", "sip.from.uri.host", "sip.from.uri.original", "sip.from.uri.original.text", "sip.from.uri.port", "sip.from.uri.scheme", "sip.from.uri.username", "sip.max_forwards", "sip.method", "sip.private.uri.host", "sip.private.uri.original", "sip.private.uri.original.text", "sip.private.uri.port", "sip.private.uri.scheme", "sip.private.uri.username", "sip.sdp.body.original", "sip.sdp.body.original.text", "sip.sdp.connection.address", "sip.sdp.connection.info", "sip.sdp.owner.ip", "sip.sdp.owner.session_id", "sip.sdp.owner.username", "sip.sdp.owner.version", "sip.sdp.session.name", "sip.sdp.version", "sip.status", "sip.supported", "sip.to.display_info", "sip.to.tag", "sip.to.uri.host", "sip.to.uri.original", "sip.to.uri.original.text", "sip.to.uri.port", "sip.to.uri.scheme", "sip.to.uri.username", "sip.type", "sip.uri.host", "sip.uri.original", "sip.uri.original.text", "sip.uri.port", "sip.uri.scheme", "sip.uri.username", "sip.user_agent.original", "sip.user_agent.original.text", "sip.version", "sip.via.original", "sip.via.original.text", "source.address", "source.as.number", "source.as.organization.name", "source.as.organization.name.text", "source.bytes", "source.domain", "source.geo.city_name", "source.geo.continent_name", "source.geo.country_iso_code", "source.geo.country_name", "source.geo.location", "source.geo.name", "source.geo.region_iso_code", "source.geo.region_name", "source.ip", "source.mac", "source.nat.ip", "source.nat.port", "source.packets", "source.port", "source.registered_domain", "source.subdomain", "source.top_level_domain", "source.user.domain", "source.user.email", "source.user.full_name", "source.user.full_name.text", "source.user.group.domain", "source.user.group.id", "source.user.group.name", "source.user.hash", "source.user.id", "source.user.name", "source.user.name.text", "source.user.roles", "span.id", "status", "system.core.id", "system.core.idle.pct", "system.core.idle.ticks", "system.core.iowait.pct", "system.core.iowait.ticks", "system.core.irq.pct", "system.core.irq.ticks", "system.core.nice.pct", "system.core.nice.ticks", "system.core.softirq.pct", "system.core.softirq.ticks", "system.core.steal.pct", "system.core.steal.ticks", "system.core.system.pct", "system.core.system.ticks", "system.core.user.pct", "system.core.user.ticks", "system.cpu.cores", "system.cpu.idle.norm.pct", "system.cpu.idle.pct", "system.cpu.idle.ticks", "system.cpu.iowait.norm.pct", "system.cpu.iowait.pct", "system.cpu.iowait.ticks", "system.cpu.irq.norm.pct", "system.cpu.irq.pct", "system.cpu.irq.ticks", "system.cpu.nice.norm.pct", "system.cpu.nice.pct", "system.cpu.nice.ticks", "system.cpu.softirq.norm.pct", "system.cpu.softirq.pct", "system.cpu.softirq.ticks", "system.cpu.steal.norm.pct", "system.cpu.steal.pct", "system.cpu.steal.ticks", "system.cpu.system.norm.pct", "system.cpu.system.pct", "system.cpu.system.ticks", "system.cpu.total.norm.pct", "system.cpu.total.pct", "system.cpu.user.norm.pct", "system.cpu.user.pct", "system.cpu.user.ticks", "system.diskio.io.ops", "system.diskio.io.time", "system.diskio.iostat.await", "system.diskio.iostat.busy", "system.diskio.iostat.queue.avg_size", "system.diskio.iostat.read.await", "system.diskio.iostat.read.per_sec.bytes", "system.diskio.iostat.read.request.merges_per_sec", "system.diskio.iostat.read.request.per_sec", "system.diskio.iostat.request.avg_size", "system.diskio.iostat.service_time", "system.diskio.iostat.write.await", "system.diskio.iostat.write.per_sec.bytes", "system.diskio.iostat.write.request.merges_per_sec", "system.diskio.iostat.write.request.per_sec", "system.diskio.name", "system.diskio.read.bytes", "system.diskio.read.count", "system.diskio.read.time", "system.diskio.serial_number", "system.diskio.write.bytes", "system.diskio.write.count", "system.diskio.write.time", "system.entropy.available_bits", "system.entropy.pct", "system.filesystem.available", "system.filesystem.device_name", "system.filesystem.files", "system.filesystem.free", "system.filesystem.free_files", "system.filesystem.mount_point", "system.filesystem.total", "system.filesystem.type", "system.filesystem.used.bytes", "system.filesystem.used.pct", "system.fsstat.count", "system.fsstat.total_files", "system.fsstat.total_size.free", "system.fsstat.total_size.total", "system.fsstat.total_size.used", "system.load.1", "system.load.15", "system.load.5", "system.load.cores", "system.load.norm.1", "system.load.norm.15", "system.load.norm.5", "system.memory.actual.free", "system.memory.actual.used.bytes", "system.memory.actual.used.pct", "system.memory.free", "system.memory.hugepages.default_size", "system.memory.hugepages.free", "system.memory.hugepages.reserved", "system.memory.hugepages.surplus", "system.memory.hugepages.swap.out.fallback", "system.memory.hugepages.swap.out.pages", "system.memory.hugepages.total", "system.memory.hugepages.used.bytes", "system.memory.hugepages.used.pct", "system.memory.page_stats.direct_efficiency.pct", "system.memory.page_stats.kswapd_efficiency.pct", "system.memory.page_stats.pgfree.pages", "system.memory.page_stats.pgscan_direct.pages", "system.memory.page_stats.pgscan_kswapd.pages", "system.memory.page_stats.pgsteal_direct.pages", "system.memory.page_stats.pgsteal_kswapd.pages", "system.memory.swap.free", "system.memory.swap.in.pages", "system.memory.swap.out.pages", "system.memory.swap.readahead.cached", "system.memory.swap.readahead.pages", "system.memory.swap.total", "system.memory.swap.used.bytes", "system.memory.swap.used.pct", "system.memory.total", "system.memory.used.bytes", "system.memory.used.pct", "system.network.in.bytes", "system.network.in.dropped", "system.network.in.errors", "system.network.in.packets", "system.network.name", "system.network.out.bytes", "system.network.out.dropped", "system.network.out.errors", "system.network.out.packets", "system.process.cgroup.blkio.id", "system.process.cgroup.blkio.path", "system.process.cgroup.blkio.total.bytes", "system.process.cgroup.blkio.total.ios", "system.process.cgroup.cpu.cfs.period.us", "system.process.cgroup.cpu.cfs.quota.us", "system.process.cgroup.cpu.cfs.shares", "system.process.cgroup.cpu.id", "system.process.cgroup.cpu.path", "system.process.cgroup.cpu.rt.period.us", "system.process.cgroup.cpu.rt.runtime.us", "system.process.cgroup.cpu.stats.periods", "system.process.cgroup.cpu.stats.throttled.ns", "system.process.cgroup.cpu.stats.throttled.periods", "system.process.cgroup.cpuacct.id", "system.process.cgroup.cpuacct.path", "system.process.cgroup.cpuacct.stats.system.ns", "system.process.cgroup.cpuacct.stats.user.ns", "system.process.cgroup.cpuacct.total.ns", "system.process.cgroup.id", "system.process.cgroup.memory.id", "system.process.cgroup.memory.kmem.failures", "system.process.cgroup.memory.kmem.limit.bytes", "system.process.cgroup.memory.kmem.usage.bytes", "system.process.cgroup.memory.kmem.usage.max.bytes", "system.process.cgroup.memory.kmem_tcp.failures", "system.process.cgroup.memory.kmem_tcp.limit.bytes", "system.process.cgroup.memory.kmem_tcp.usage.bytes", "system.process.cgroup.memory.kmem_tcp.usage.max.bytes", "system.process.cgroup.memory.mem.failures", "system.process.cgroup.memory.mem.limit.bytes", "system.process.cgroup.memory.mem.usage.bytes", "system.process.cgroup.memory.mem.usage.max.bytes", "system.process.cgroup.memory.memsw.failures", "system.process.cgroup.memory.memsw.limit.bytes", "system.process.cgroup.memory.memsw.usage.bytes", "system.process.cgroup.memory.memsw.usage.max.bytes", "system.process.cgroup.memory.path", "system.process.cgroup.memory.stats.active_anon.bytes", "system.process.cgroup.memory.stats.active_file.bytes", "system.process.cgroup.memory.stats.cache.bytes", "system.process.cgroup.memory.stats.hierarchical_memory_limit.bytes", "system.process.cgroup.memory.stats.hierarchical_memsw_limit.bytes", "system.process.cgroup.memory.stats.inactive_anon.bytes", "system.process.cgroup.memory.stats.inactive_file.bytes", "system.process.cgroup.memory.stats.major_page_faults", "system.process.cgroup.memory.stats.mapped_file.bytes", "system.process.cgroup.memory.stats.page_faults", "system.process.cgroup.memory.stats.pages_in", "system.process.cgroup.memory.stats.pages_out", "system.process.cgroup.memory.stats.rss.bytes", "system.process.cgroup.memory.stats.rss_huge.bytes", "system.process.cgroup.memory.stats.swap.bytes", "system.process.cgroup.memory.stats.unevictable.bytes", "system.process.cgroup.path", "system.process.cmdline", "system.process.cpu.start_time", "system.process.cpu.system.ticks", "system.process.cpu.total.norm.pct", "system.process.cpu.total.pct", "system.process.cpu.total.ticks", "system.process.cpu.total.value", "system.process.cpu.user.ticks", "system.process.fd.limit.hard", "system.process.fd.limit.soft", "system.process.fd.open", "system.process.memory.rss.bytes", "system.process.memory.rss.pct", "system.process.memory.share", "system.process.memory.size", "system.process.state", "system.process.summary.dead", "system.process.summary.idle", "system.process.summary.running", "system.process.summary.sleeping", "system.process.summary.stopped", "system.process.summary.total", "system.process.summary.unknown", "system.process.summary.zombie", "system.raid.blocks.synced", "system.raid.blocks.total", "system.raid.disks.active", "system.raid.disks.failed", "system.raid.disks.spare", "system.raid.disks.total", "system.raid.level", "system.raid.name", "system.raid.status", "system.raid.sync_action", "system.service.exec_code", "system.service.load_state", "system.service.name", "system.service.resources.cpu.usage.ns", "system.service.resources.memory.usage.bytes", "system.service.resources.network.in.bytes", "system.service.resources.network.in.packets", "system.service.resources.network.out.bytes", "system.service.resources.network.out.packets", "system.service.resources.tasks.count", "system.service.state", "system.service.state_since", "system.service.sub_state", "system.service.unit_file.state", "system.service.unit_file.vendor_preset", "system.socket.local.ip", "system.socket.local.port", "system.socket.process.cmdline", "system.socket.remote.etld_plus_one", "system.socket.remote.host", "system.socket.remote.host_error", "system.socket.remote.ip", "system.socket.remote.port", "system.socket.summary.all.count", "system.socket.summary.all.listening", "system.socket.summary.tcp.all.close_wait", "system.socket.summary.tcp.all.closing", "system.socket.summary.tcp.all.count", "system.socket.summary.tcp.all.established", "system.socket.summary.tcp.all.fin_wait1", "system.socket.summary.tcp.all.fin_wait2", "system.socket.summary.tcp.all.last_ack", "system.socket.summary.tcp.all.listening", "system.socket.summary.tcp.all.orphan", "system.socket.summary.tcp.all.syn_recv", "system.socket.summary.tcp.all.syn_sent", "system.socket.summary.tcp.all.time_wait", "system.socket.summary.tcp.memory", "system.socket.summary.udp.all.count", "system.socket.summary.udp.memory", "system.uptime.duration.ms", "system.users.id", "system.users.leader", "system.users.path", "system.users.remote", "system.users.remote_host", "system.users.scope", "system.users.seat", "system.users.service", "system.users.state", "system.users.type", "systemd.fragment_path", "systemd.unit", "tags", "threat.framework", "threat.tactic.id", "threat.tactic.name", "threat.tactic.reference", "threat.technique.id", "threat.technique.name", "threat.technique.name.text", "threat.technique.reference", "threat.technique.subtechnique.id", "threat.technique.subtechnique.name", "threat.technique.subtechnique.name.text", "threat.technique.subtechnique.reference", "thrift.exceptions", "thrift.params", "thrift.return_value", "thrift.service", "timeseries.instance", "tls.alert_types", "tls.cipher", "tls.client.certificate", "tls.client.certificate_chain", "tls.client.hash.md5", "tls.client.hash.sha1", "tls.client.hash.sha256", "tls.client.issuer", "tls.client.ja3", "tls.client.not_after", "tls.client.not_before", "tls.client.server_name", "tls.client.subject", "tls.client.supported_ciphers", "tls.client.x509.alternative_names", "tls.client.x509.issuer.common_name", "tls.client.x509.issuer.country", "tls.client.x509.issuer.distinguished_name", "tls.client.x509.issuer.locality", "tls.client.x509.issuer.organization", "tls.client.x509.issuer.organizational_unit", "tls.client.x509.issuer.province", "tls.client.x509.issuer.state_or_province", "tls.client.x509.not_after", "tls.client.x509.not_before", "tls.client.x509.public_key_algorithm", "tls.client.x509.public_key_curve", "tls.client.x509.public_key_exponent", "tls.client.x509.public_key_size", "tls.client.x509.serial_number", "tls.client.x509.signature_algorithm", "tls.client.x509.subject.common_name", "tls.client.x509.subject.country", "tls.client.x509.subject.distinguished_name", "tls.client.x509.subject.locality", "tls.client.x509.subject.organization", "tls.client.x509.subject.organizational_unit", "tls.client.x509.subject.province", "tls.client.x509.subject.state_or_province", "tls.client.x509.version", "tls.client.x509.version_number", "tls.client_certificate.alternative_names", "tls.client_certificate.issuer.common_name", "tls.client_certificate.issuer.country", "tls.client_certificate.issuer.locality", "tls.client_certificate.issuer.organization", "tls.client_certificate.issuer.organizational_unit", "tls.client_certificate.issuer.province", "tls.client_certificate.not_after", "tls.client_certificate.not_before", "tls.client_certificate.public_key_algorithm", "tls.client_certificate.public_key_size", "tls.client_certificate.serial_number", "tls.client_certificate.signature_algorithm", "tls.client_certificate.subject.common_name", "tls.client_certificate.subject.country", "tls.client_certificate.subject.locality", "tls.client_certificate.subject.organization", "tls.client_certificate.subject.organizational_unit", "tls.client_certificate.subject.province", "tls.client_certificate.version", "tls.client_certificate_requested", "tls.client_hello.extensions._unparsed_", "tls.client_hello.extensions.application_layer_protocol_negotiation", "tls.client_hello.extensions.ec_points_formats", "tls.client_hello.extensions.server_name_indication", "tls.client_hello.extensions.session_ticket", "tls.client_hello.extensions.signature_algorithms", "tls.client_hello.extensions.supported_groups", "tls.client_hello.extensions.supported_versions", "tls.client_hello.session_id", "tls.client_hello.supported_ciphers", "tls.client_hello.supported_compression_methods", "tls.client_hello.version", "tls.curve", "tls.detailed.alert_types", "tls.detailed.client_certificate.alternative_names", "tls.detailed.client_certificate.issuer.common_name", "tls.detailed.client_certificate.issuer.country", "tls.detailed.client_certificate.issuer.distinguished_name", "tls.detailed.client_certificate.issuer.locality", "tls.detailed.client_certificate.issuer.organization", "tls.detailed.client_certificate.issuer.organizational_unit", "tls.detailed.client_certificate.issuer.province", "tls.detailed.client_certificate.not_after", "tls.detailed.client_certificate.not_before", "tls.detailed.client_certificate.public_key_algorithm", "tls.detailed.client_certificate.public_key_size", "tls.detailed.client_certificate.serial_number", "tls.detailed.client_certificate.signature_algorithm", "tls.detailed.client_certificate.subject.common_name", "tls.detailed.client_certificate.subject.country", "tls.detailed.client_certificate.subject.distinguished_name", "tls.detailed.client_certificate.subject.locality", "tls.detailed.client_certificate.subject.organization", "tls.detailed.client_certificate.subject.organizational_unit", "tls.detailed.client_certificate.subject.province", "tls.detailed.client_certificate.version", "tls.detailed.client_certificate.version_number", "tls.detailed.client_certificate_requested", "tls.detailed.client_hello.extensions._unparsed_", "tls.detailed.client_hello.extensions.application_layer_protocol_negotiation", "tls.detailed.client_hello.extensions.ec_points_formats", "tls.detailed.client_hello.extensions.server_name_indication", "tls.detailed.client_hello.extensions.session_ticket", "tls.detailed.client_hello.extensions.signature_algorithms", "tls.detailed.client_hello.extensions.supported_groups", "tls.detailed.client_hello.extensions.supported_versions", "tls.detailed.client_hello.session_id", "tls.detailed.client_hello.supported_compression_methods", "tls.detailed.client_hello.version", "tls.detailed.resumption_method", "tls.detailed.server_certificate.alternative_names", "tls.detailed.server_certificate.issuer.common_name", "tls.detailed.server_certificate.issuer.country", "tls.detailed.server_certificate.issuer.distinguished_name", "tls.detailed.server_certificate.issuer.locality", "tls.detailed.server_certificate.issuer.organization", "tls.detailed.server_certificate.issuer.organizational_unit", "tls.detailed.server_certificate.issuer.province", "tls.detailed.server_certificate.issuer.state_or_province", "tls.detailed.server_certificate.not_after", "tls.detailed.server_certificate.not_before", "tls.detailed.server_certificate.public_key_algorithm", "tls.detailed.server_certificate.public_key_size", "tls.detailed.server_certificate.serial_number", "tls.detailed.server_certificate.signature_algorithm", "tls.detailed.server_certificate.subject.common_name", "tls.detailed.server_certificate.subject.country", "tls.detailed.server_certificate.subject.distinguished_name", "tls.detailed.server_certificate.subject.locality", "tls.detailed.server_certificate.subject.organization", "tls.detailed.server_certificate.subject.organizational_unit", "tls.detailed.server_certificate.subject.province", "tls.detailed.server_certificate.subject.state_or_province", "tls.detailed.server_certificate.version", "tls.detailed.server_certificate.version_number", "tls.detailed.server_certificate_chain.issuer.common_name", "tls.detailed.server_certificate_chain.issuer.country", "tls.detailed.server_certificate_chain.issuer.distinguished_name", "tls.detailed.server_certificate_chain.issuer.locality", "tls.detailed.server_certificate_chain.issuer.organization", "tls.detailed.server_certificate_chain.issuer.organizational_unit", "tls.detailed.server_certificate_chain.issuer.province", "tls.detailed.server_certificate_chain.issuer.state_or_province", "tls.detailed.server_certificate_chain.not_after", "tls.detailed.server_certificate_chain.not_before", "tls.detailed.server_certificate_chain.public_key_algorithm", "tls.detailed.server_certificate_chain.public_key_size", "tls.detailed.server_certificate_chain.serial_number", "tls.detailed.server_certificate_chain.signature_algorithm", "tls.detailed.server_certificate_chain.subject.common_name", "tls.detailed.server_certificate_chain.subject.country", "tls.detailed.server_certificate_chain.subject.distinguished_name", "tls.detailed.server_certificate_chain.subject.locality", "tls.detailed.server_certificate_chain.subject.organization", "tls.detailed.server_certificate_chain.subject.organizational_unit", "tls.detailed.server_certificate_chain.subject.province", "tls.detailed.server_certificate_chain.subject.state_or_province", "tls.detailed.server_certificate_chain.version", "tls.detailed.server_certificate_chain.version_number", "tls.detailed.server_hello.extensions._unparsed_", "tls.detailed.server_hello.extensions.application_layer_protocol_negotiation", "tls.detailed.server_hello.extensions.ec_points_formats", "tls.detailed.server_hello.extensions.session_ticket", "tls.detailed.server_hello.extensions.supported_versions", "tls.detailed.server_hello.selected_compression_method", "tls.detailed.server_hello.session_id", "tls.detailed.server_hello.version", "tls.detailed.version", "tls.established", "tls.fingerprints.ja3", "tls.handshake_completed", "tls.next_protocol", "tls.resumed", "tls.resumption_method", "tls.server.certificate", "tls.server.certificate_chain", "tls.server.hash.md5", "tls.server.hash.sha1", "tls.server.hash.sha256", "tls.server.issuer", "tls.server.ja3s", "tls.server.not_after", "tls.server.not_before", "tls.server.subject", "tls.server.x509.alternative_names", "tls.server.x509.issuer.common_name", "tls.server.x509.issuer.country", "tls.server.x509.issuer.distinguished_name", "tls.server.x509.issuer.locality", "tls.server.x509.issuer.organization", "tls.server.x509.issuer.organizational_unit", "tls.server.x509.issuer.province", "tls.server.x509.issuer.state_or_province", "tls.server.x509.not_after", "tls.server.x509.not_before", "tls.server.x509.public_key_algorithm", "tls.server.x509.public_key_curve", "tls.server.x509.public_key_exponent", "tls.server.x509.public_key_size", "tls.server.x509.serial_number", "tls.server.x509.signature_algorithm", "tls.server.x509.subject.common_name", "tls.server.x509.subject.country", "tls.server.x509.subject.distinguished_name", "tls.server.x509.subject.locality", "tls.server.x509.subject.organization", "tls.server.x509.subject.organizational_unit", "tls.server.x509.subject.province", "tls.server.x509.subject.state_or_province", "tls.server.x509.version", "tls.server.x509.version_number", "tls.server_certificate.alternative_names", "tls.server_certificate.issuer.common_name", "tls.server_certificate.issuer.country", "tls.server_certificate.issuer.locality", "tls.server_certificate.issuer.organization", "tls.server_certificate.issuer.organizational_unit", "tls.server_certificate.issuer.province", "tls.server_certificate.not_after", "tls.server_certificate.not_before", "tls.server_certificate.public_key_algorithm", "tls.server_certificate.public_key_size", "tls.server_certificate.serial_number", "tls.server_certificate.signature_algorithm", "tls.server_certificate.subject.common_name", "tls.server_certificate.subject.country", "tls.server_certificate.subject.locality", "tls.server_certificate.subject.organization", "tls.server_certificate.subject.organizational_unit", "tls.server_certificate.subject.province", "tls.server_certificate.version", "tls.server_hello.extensions._unparsed_", "tls.server_hello.extensions.application_layer_protocol_negotiation", "tls.server_hello.extensions.ec_points_formats", "tls.server_hello.extensions.session_ticket", "tls.server_hello.extensions.supported_versions", "tls.server_hello.selected_cipher", "tls.server_hello.selected_compression_method", "tls.server_hello.session_id", "tls.server_hello.version", "tls.version", "tls.version_protocol", "trace.id", "tracing.trace.id", "tracing.transaction.id", "traefik.health.response.avg_time.us", "traefik.health.response.count", "traefik.health.uptime.sec", "transaction.id", "type", "url.domain", "url.extension", "url.fragment", "url.full", "url.full.text", "url.original", "url.original.text", "url.password", "url.path", "url.port", "url.query", "url.registered_domain", "url.scheme", "url.subdomain", "url.top_level_domain", "url.username", "user.domain", "user.email", "user.full_name", "user.full_name.text", "user.group.domain", "user.group.id", "user.group.name", "user.hash", "user.id", "user.name", "user.name.text", "user.roles", "user_agent.device.name", "user_agent.name", "user_agent.original", "user_agent.original.text", "user_agent.os.family", "user_agent.os.full", "user_agent.os.full.text", "user_agent.os.kernel", "user_agent.os.name", "user_agent.os.name.text", "user_agent.os.platform", "user_agent.os.version", "user_agent.version", "uwsgi.status.core.id", "uwsgi.status.core.read_errors", "uwsgi.status.core.requests.offloaded", "uwsgi.status.core.requests.routed", "uwsgi.status.core.requests.static", "uwsgi.status.core.requests.total", "uwsgi.status.core.worker_pid", "uwsgi.status.core.write_errors", "uwsgi.status.total.exceptions", "uwsgi.status.total.pid", "uwsgi.status.total.read_errors", "uwsgi.status.total.requests", "uwsgi.status.total.write_errors", "uwsgi.status.worker.accepting", "uwsgi.status.worker.avg_rt", "uwsgi.status.worker.delta_requests", "uwsgi.status.worker.exceptions", "uwsgi.status.worker.harakiri_count", "uwsgi.status.worker.id", "uwsgi.status.worker.pid", "uwsgi.status.worker.requests", "uwsgi.status.worker.respawn_count", "uwsgi.status.worker.rss", "uwsgi.status.worker.running_time", "uwsgi.status.worker.signal_queue", "uwsgi.status.worker.signals", "uwsgi.status.worker.status", "uwsgi.status.worker.tx", "uwsgi.status.worker.vsz", "vlan.id", "vlan.name", "vsphere.datastore.capacity.free.bytes", "vsphere.datastore.capacity.total.bytes", "vsphere.datastore.capacity.used.bytes", "vsphere.datastore.capacity.used.pct", "vsphere.datastore.fstype", "vsphere.datastore.name", "vsphere.host.cpu.free.mhz", "vsphere.host.cpu.total.mhz", "vsphere.host.cpu.used.mhz", "vsphere.host.memory.free.bytes", "vsphere.host.memory.total.bytes", "vsphere.host.memory.used.bytes", "vsphere.host.name", "vsphere.host.network_names", "vsphere.virtualmachine.cpu.used.mhz", "vsphere.virtualmachine.host.hostname", "vsphere.virtualmachine.host.id", "vsphere.virtualmachine.memory.free.guest.bytes", "vsphere.virtualmachine.memory.total.guest.bytes", "vsphere.virtualmachine.memory.used.guest.bytes", "vsphere.virtualmachine.memory.used.host.bytes", "vsphere.virtualmachine.name", "vsphere.virtualmachine.network_names", "vsphere.virtualmachine.os", "vulnerability.category", "vulnerability.classification", "vulnerability.description", "vulnerability.description.text", "vulnerability.enumeration", "vulnerability.id", "vulnerability.reference", "vulnerability.report_id", "vulnerability.scanner.vendor", "vulnerability.score.base", "vulnerability.score.environmental", "vulnerability.score.temporal", "vulnerability.score.version", "vulnerability.severity", "windows.perfmon.instance", "windows.service.display_name", "windows.service.exit_code", "windows.service.id", "windows.service.name", "windows.service.path_name", "windows.service.pid", "windows.service.start_name", "windows.service.start_type", "windows.service.state", "windows.service.uptime.ms", "x509.alternative_names", "x509.issuer.common_name", "x509.issuer.country", "x509.issuer.distinguished_name", "x509.issuer.locality", "x509.issuer.organization", "x509.issuer.organizational_unit", "x509.issuer.state_or_province", "x509.not_after", "x509.not_before", "x509.public_key_algorithm", "x509.public_key_curve", "x509.public_key_exponent", "x509.public_key_size", "x509.serial_number", "x509.signature_algorithm", "x509.subject.common_name", "x509.subject.country", "x509.subject.distinguished_name", "x509.subject.locality", "x509.subject.organization", "x509.subject.organizational_unit", "x509.subject.state_or_province", "x509.version_number", "zookeeper.connection.interest_ops", "zookeeper.connection.queued", "zookeeper.connection.received", "zookeeper.connection.sent", "zookeeper.mntr.approximate_data_size", "zookeeper.mntr.ephemerals_count", "zookeeper.mntr.followers", "zookeeper.mntr.hostname", "zookeeper.mntr.latency.avg", "zookeeper.mntr.latency.max", "zookeeper.mntr.latency.min", "zookeeper.mntr.max_file_descriptor_count", "zookeeper.mntr.num_alive_connections", "zookeeper.mntr.open_file_descriptor_count", "zookeeper.mntr.outstanding_requests", "zookeeper.mntr.packets.received", "zookeeper.mntr.packets.sent", "zookeeper.mntr.pending_syncs", "zookeeper.mntr.server_state", "zookeeper.mntr.synced_followers", "zookeeper.mntr.version", "zookeeper.mntr.watch_count", "zookeeper.mntr.znode_count", "zookeeper.server.connections", "zookeeper.server.count", "zookeeper.server.epoch", "zookeeper.server.latency.avg", "zookeeper.server.latency.max", "zookeeper.server.latency.min", "zookeeper.server.mode", "zookeeper.server.node_count", "zookeeper.server.outstanding", "zookeeper.server.received", "zookeeper.server.sent", "zookeeper.server.version_date", "zookeeper.server.zxid" ], "runtime_mappings": {}, "_source": { "excludes": [ "aero*" ] }, "query": { "bool": { "must": [], "filter": [ { "match_all": {} }, { "range": { "@timestamp": { "gte": "2021-02-23T12:56:01.284Z", "lte": "2021-02-23T13:11:01.284Z", "format": "strict_date_optional_time" } } } ], "should": [], "must_not": [] } }, "highlight": { "pre_tags": [ "@kibana-highlighted-field@" ], "post_tags": [ "@/kibana-highlighted-field@" ], "fields": { "*": {} }, "fragment_size": 2147483647 } } ```

[timroes]

The problem here is that we're requesting stored_fields explicitly in 7.12 for those "non leaf" fields in the rollup index. Beforehand we've requested *. I'll sync with @lukeelmers later and talk about that.

[timroes]

I've discussed this with Luke offline. Given that we don't see much use-case in that specific combination of having stored_fields and rollup v1 at the same time, we discussed that our preferred way would be to simply not sending stored_fields with an explicit list when a rollup index pattern is used. Fields inside a rollup index pattern are anyway never stored fields and the chance we're mixing it with a live index pattern that uses stored fields that are not mapped (and thus not working in the fields API) is rather low.

I.e. we would like to make https://github.com/elastic/kibana/blob/master/src/plugins/data/common/search/search_source/search_source.ts#L619 conditional to only be called on non rollup index patterns.

Since we have no urgency for 7.12 to get this in, I want to ask @ppisljar if app services team could just take that into their planning for 7.13, since it's a rather minor adjustment to the search source?

[elasticmachine]

Pinging @elastic/kibana-app-services (Team:AppServices)

[ppisljar]

isn't this a regression introduced in 7.12 ? if so we should probably try to fix it ASAP (and our fix it week is next week).

[timroes]

Yes it's a regression introduced in 7.12, though it should be a really nieche that ever have a valid scenario for that and I think it only fails in Discover (as the only consumer of raw documents in search source + rollup index patterns atm?) and if we fix it as above, we don't restore previous behavior, but would disable stored_fields with rollup index patterns (which to Luke and my impression is fine, but we can sync about it again if you have doubts about that).

[lukasolson]

I'm not able to reproduce this. It looks to me like we're requesting "stored_fields": ["*"] even for rollup index patterns with discover:searchFieldsFromSource enabled, and the query succeeds.