ECS fields used in Beats.
| Field | Description | Level | Type | Example |
|---|---|---|---|---|
| id | Unique id to describe the event. | (use case) | keyword | 8a4f500d |
| timestamp | Timestamp when the event was created. | (use case) | date | 2016-05-23T08:05:34.853Z |
| agent.* | The agent fields are used to describe by which beat the information was collected. |
|||
| agent.version | Beat version. | core | keyword | 6.0.0-rc2 |
| agent.name | Beat name. | core | keyword | filebeat |
| agent.id | Unique beat identifier. | core | keyword | 8a4f500d |