Add fields for Operating Systemd data

There were some previous discussions around the version field and if it should split up into major, minor, bugfix, patch. I chose to only go with `version` based on the assumption that if someone searches for a specific minor version he will know the major version. So searching for it can be done with a prefix query based on version keyword.

CHANGELOG.md

@@ -9,6 +9,8 @@ All notable changes to this project will be documented in this file based on the
 ### Bugfixes
 
 ### Added
-Adds cloud.account.id for top level organizational level.
+
+* Adds cloud.account.id for top level organizational level. #11
+* Add fields for Operating System data. #5
 
 ### Deprecated

README.md

@@ -36,6 +36,7 @@ List of available ECS fields.
  * [Log fields](#log)
  * [Network fields](#network)
  * [Organization fields](#organization)
+ * [Operating System fields](#os)
  * [Process fields](#process)
  * [Service fields](#service)
  * [Source fields](#source)
@@ -293,6 +294,21 @@ This can be useful if data should stored in the same index should be sometimes f
 | <a name="organization.id"></a>`organization.id`  | Unique identifier for the organization.  | keyword  |   |   |
 
 
+## <a name="os"></a> Operating System fields
+
+The OS fields contain information about the operating system and contains.
+
+The os fields are often used inside other prefixes like `host.os.*` or `user_agent.os.*`.
+
+
+| Field  | Description  | Type  | Multi Field  | Example  |
+|---|---|---|---|---|
+| <a name="os.platform"></a>`os.platform`  | Operating system platform (e.g. centos, ubuntu, windows).  | keyword  |   | `darwin`  |
+| <a name="os.name"></a>`os.name`  | Operating system name.  | keyword  |   | `Mac OS X`  |
+| <a name="os.family"></a>`os.family`  | OS family (e.g. redhat, debian, freebsd, windows).  | keyword  |   | `debian`  |
+| <a name="os.version"></a>`os.version`  | Operating system version as a raw string.  | keyword  |   | `10.12.6-rc2`  |
+
+
 ## <a name="process"></a> Process fields
 
 These fields contain information about a process.

schema.csv

@@ -96,6 +96,10 @@ network.outbound.packets,long,0,12
 network.protocol,keyword,0,http
 organization.id,keyword,0,
 organization.name,text,0,
+os.family,keyword,0,debian
+os.name,keyword,0,Mac OS X
+os.platform,keyword,0,darwin
+os.version,keyword,0,10.12.6-rc2
 process.args,keyword,0,"['-l', 'user', '10.0.0.16']"
 process.name,keyword,0,ssh
 process.pid,long,0,

schemas/os.yml

@@ -0,0 +1,28 @@
+- name: os
+  title: Operating System
+  group: 2
+  description: >
+    The OS fields contain information about the operating system and contains.
+
+    The os fields are often used inside other prefixes like `host.os.*` or `user_agent.os.*`.
+  fields:
+    - name: platform
+      type: keyword
+      description: >
+        Operating system platform (e.g. centos, ubuntu, windows).
+      example: darwin
+    - name: name
+      type: keyword
+      example: "Mac OS X"
+      description: >
+        Operating system name.
+    - name: family
+      type: keyword
+      example: "debian"
+      description: >
+        OS family (e.g. redhat, debian, freebsd, windows).
+    - name: version
+      type: keyword
+      example: "10.12.6-rc2"
+      description: >
+        Operating system version as a raw string.

template.json

@@ -498,6 +498,26 @@
             }
           }
         },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
         "process": {
           "properties": {
             "args": {