custom_os.yml

---
- name: os
  title: Custom OS
  group: 2
  short: TODO
  description: >
    TODO
  type: group
  reusable:
    top_level: false
    expected:
      - host
  fields:
    - name: full
      multi_fields:
        - name: caseless
          type: keyword
          normalizer: lowercase
        - name: text
          type: text

    - name: name
      multi_fields:
        - name: caseless
          type: keyword
          normalizer: lowercase
        - name: text
          type: text

    - name: Ext
      level: custom
      type: object
      description: Object for all custom defined fields to live in.

    # this is temporary until variant is included in ecs core https://github.com/elastic/ecs/issues/744
    - name: Ext.variant
      level: custom
      type: keyword
      description: >
        A string value or phrase that further aid to classify or qualify the operating system (OS). 
        For example the distribution for a Linux OS will be entered in this field.
      short: A string value or phrase that further aid to classify or qualify the operating system (OS).
      example: Ubuntu