Report the source of each event (state change, attribute change, publish all)

[strawgate]

We should include an event.action field on each document which includes whether the document was produced as the result of state/attribute change tracker or as the result of polling all entities.

[legrego]

Are there other event fields that you think could be useful?

event.kind - state or event (I'm unclear which makes the most sense based on https://www.elastic.co/guide/en/ecs/current/ecs-allowed-values-event-kind.html#ecs-event-kind-state) event.type - change for state/attribute changes, or info for entities that didn't change via "publish all".

I also don't want to add fields for the sake of adding them. I feel like event.action would fulfill our immediate needs, but I wanted to at least discuss before we raise a PR.

[strawgate]

looks like event.kind: state is meant for enumeration type value changes so probably event.kind: event:

The state value is similar to metric, indicating that this event describes a measurement taken at given point in time, except that the measurement does not result in a numeric value, but rather one of a fixed set of categorical values that represent conditions or states.

event.type : change makes sense to me