http.yml

---
- name: http
  title: HTTP
  group: 2
  short: Fields describing an HTTP request.
  description: >
    Fields related to HTTP activity. Use the `url` field set to store the url of the request.
  type: group
  fields:

    - name: request.method
      level: extended
      type: keyword
      short: HTTP request method.
      description: >
        HTTP request method.

        Prior to ECS 1.6.0 the following guidance was provided:

        "The field value must be normalized to lowercase for
        querying."

        As of ECS 1.6.0, the guidance is deprecated because the
        original case of the method may be useful in anomaly
        detection.  Original case will be mandated in ECS 2.0.0

      example: GET, POST, PUT, PoST

    - name: request.mime_type
      level: extended
      type: keyword
      short: Mime type of the body of the request.
      description: >
       Mime type of the body of the request.

       This value must only be populated based on the content of the request
       body, not on the `Content-Type` header. Comparing the mime type of a
       request with the request's Content-Type header can be helpful in detecting
       threats or misconfigured clients.

      example: image/gif

    - name: request.body.content
      level: extended
      type: keyword
      description: >
        The full HTTP request body.
      example: Hello world
      multi_fields:
      - type: text
        name: text

    - name: request.referrer
      level: extended
      type: keyword
      description: >
        Referrer for this HTTP request.
      example: https://blog.example.com/

    - name: response.status_code
      format: string
      level: extended
      type: long
      description: >
        HTTP response status code.
      example: 404

    - name: response.mime_type
      level: extended
      type: keyword
      short: Mime type of the body of the response.
      description: >
       Mime type of the body of the response.

       This value must only be populated based on the content of the response
       body, not on the `Content-Type` header. Comparing the mime type of a
       response with the response's Content-Type header can be helpful in detecting
       misconfigured servers.

      example: image/gif

    - name: response.body.content
      level: extended
      type: keyword
      description: >
        The full HTTP response body.
      example: Hello world
      multi_fields:
      - type: text
        name: text

    - name: version
      level: extended
      type: keyword
      description: >
        HTTP version.
      example: 1.1

    # Metrics
    - name: request.bytes
      level: extended
      type: long
      format: bytes
      description: >
        Total size in bytes of the request (body and headers).
      example: 1437

    - name: request.body.bytes
      level: extended
      type: long
      format: bytes
      description: >
        Size in bytes of the request body.
      example: 887

    - name: response.bytes
      level: extended
      type: long
      format: bytes
      description: >
        Total size in bytes of the response (body and headers).
      example: 1437

    - name: response.body.bytes
      level: extended
      type: long
      format: bytes
      description: >
        Size in bytes of the response body.
      example: 887