[1.x] add cloud.service.name (#1204) (#1224)

* add cloud.platform

* expand cloud.platform description

* move to cloud.service.name

Co-authored-by: Gil Raphaelli <gil@elastic.co>

CHANGELOG.next.md

@@ -18,6 +18,7 @@ Thanks, you're awesome :-) -->
 #### Added
 
 * Added `http.request.id`. #1208
+* Added `cloud.service.name`. #1204
 
 #### Improvements
 

docs/field-details.asciidoc

@@ -738,6 +738,24 @@ example: `us-east-1`
 
 // ===============================================================
 
+|
+[[field-cloud-service-name]]
+<<field-cloud-service-name, cloud.service.name>>
+
+| The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server.
+
+Examples: app engine, app service, cloud run, fargate, lambda.
+
+type: keyword
+
+
+
+example: `lambda`
+
+| extended
+
+// ===============================================================
+
 |=====
 
 [[ecs-code_signature]]

experimental/generated/beats/fields.ecs.yml

@@ -476,6 +476,17 @@
       ignore_above: 1024
       description: Region in which this host is running.
       example: us-east-1
+    - name: service.name
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: 'The cloud service name is intended to distinguish services running
+        on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs
+        App Engine, Azure VM vs App Server.
+
+        Examples: app engine, app service, cloud run, fargate, lambda.'
+      example: lambda
+      default_field: false
   - name: code_signature
     title: Code Signature
     group: 2

experimental/generated/csv/fields.csv

@@ -54,6 +54,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 1.9.0-dev+exp,true,cloud,cloud.project.name,keyword,extended,,my project,The cloud project name.
 1.9.0-dev+exp,true,cloud,cloud.provider,keyword,extended,,aws,Name of the cloud provider.
 1.9.0-dev+exp,true,cloud,cloud.region,keyword,extended,,us-east-1,Region in which this host is running.
+1.9.0-dev+exp,true,cloud,cloud.service.name,keyword,extended,,lambda,The cloud service name.
 1.9.0-dev+exp,true,container,container.id,keyword,core,,,Unique container id.
 1.9.0-dev+exp,true,container,container.image.name,keyword,extended,,,Name of the image the container was built on.
 1.9.0-dev+exp,true,container,container.image.tag,keyword,extended,array,,Container image tags.

experimental/generated/ecs/ecs_flat.yml

@@ -643,6 +643,21 @@ cloud.region:
   normalize: []
   short: Region in which this host is running.
   type: keyword
+cloud.service.name:
+  dashed_name: cloud-service-name
+  description: 'The cloud service name is intended to distinguish services running
+    on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App
+    Engine, Azure VM vs App Server.
+
+    Examples: app engine, app service, cloud run, fargate, lambda.'
+  example: lambda
+  flat_name: cloud.service.name
+  ignore_above: 1024
+  level: extended
+  name: service.name
+  normalize: []
+  short: The cloud service name.
+  type: keyword
 container.id:
   dashed_name: container-id
   description: Unique container id.

experimental/generated/ecs/ecs_nested.yml

@@ -814,6 +814,21 @@ cloud:
       normalize: []
       short: Region in which this host is running.
       type: keyword
+    cloud.service.name:
+      dashed_name: cloud-service-name
+      description: 'The cloud service name is intended to distinguish services running
+        on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs
+        App Engine, Azure VM vs App Server.
+
+        Examples: app engine, app service, cloud run, fargate, lambda.'
+      example: lambda
+      flat_name: cloud.service.name
+      ignore_above: 1024
+      level: extended
+      name: service.name
+      normalize: []
+      short: The cloud service name.
+      type: keyword
   footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from
     its host, the cloud info contains the data about this machine. If Metricbeat runs
     on a remote machine outside the cloud and fetches data from a service running

experimental/generated/elasticsearch/7/template.json

@@ -269,6 +269,14 @@
           "region": {
             "ignore_above": 1024,
             "type": "keyword"
+          },
+          "service": {
+            "properties": {
+              "name": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
           }
         }
       },

experimental/generated/elasticsearch/component/cloud.json

@@ -63,6 +63,14 @@
             "region": {
               "ignore_above": 1024,
               "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
             }
           }
         }

generated/beats/fields.ecs.yml

@@ -476,6 +476,17 @@
       ignore_above: 1024
       description: Region in which this host is running.
       example: us-east-1
+    - name: service.name
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: 'The cloud service name is intended to distinguish services running
+        on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs
+        App Engine, Azure VM vs App Server.
+
+        Examples: app engine, app service, cloud run, fargate, lambda.'
+      example: lambda
+      default_field: false
   - name: code_signature
     title: Code Signature
     group: 2

generated/csv/fields.csv

@@ -54,6 +54,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 1.9.0-dev,true,cloud,cloud.project.name,keyword,extended,,my project,The cloud project name.
 1.9.0-dev,true,cloud,cloud.provider,keyword,extended,,aws,Name of the cloud provider.
 1.9.0-dev,true,cloud,cloud.region,keyword,extended,,us-east-1,Region in which this host is running.
+1.9.0-dev,true,cloud,cloud.service.name,keyword,extended,,lambda,The cloud service name.
 1.9.0-dev,true,container,container.id,keyword,core,,,Unique container id.
 1.9.0-dev,true,container,container.image.name,keyword,extended,,,Name of the image the container was built on.
 1.9.0-dev,true,container,container.image.tag,keyword,extended,array,,Container image tags.

generated/ecs/ecs_flat.yml

@@ -643,6 +643,21 @@ cloud.region:
   normalize: []
   short: Region in which this host is running.
   type: keyword
+cloud.service.name:
+  dashed_name: cloud-service-name
+  description: 'The cloud service name is intended to distinguish services running
+    on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App
+    Engine, Azure VM vs App Server.
+
+    Examples: app engine, app service, cloud run, fargate, lambda.'
+  example: lambda
+  flat_name: cloud.service.name
+  ignore_above: 1024
+  level: extended
+  name: service.name
+  normalize: []
+  short: The cloud service name.
+  type: keyword
 container.id:
   dashed_name: container-id
   description: Unique container id.

generated/ecs/ecs_nested.yml

@@ -814,6 +814,21 @@ cloud:
       normalize: []
       short: Region in which this host is running.
       type: keyword
+    cloud.service.name:
+      dashed_name: cloud-service-name
+      description: 'The cloud service name is intended to distinguish services running
+        on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs
+        App Engine, Azure VM vs App Server.
+
+        Examples: app engine, app service, cloud run, fargate, lambda.'
+      example: lambda
+      flat_name: cloud.service.name
+      ignore_above: 1024
+      level: extended
+      name: service.name
+      normalize: []
+      short: The cloud service name.
+      type: keyword
   footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from
     its host, the cloud info contains the data about this machine. If Metricbeat runs
     on a remote machine outside the cloud and fetches data from a service running

generated/elasticsearch/6/template.json

@@ -278,6 +278,14 @@
             "region": {
               "ignore_above": 1024,
               "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
             }
           }
         },

generated/elasticsearch/7/template.json

@@ -269,6 +269,14 @@
           "region": {
             "ignore_above": 1024,
             "type": "keyword"
+          },
+          "service": {
+            "properties": {
+              "name": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
           }
         }
       },

generated/elasticsearch/component/cloud.json

@@ -63,6 +63,14 @@
             "region": {
               "ignore_above": 1024,
               "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
             }
           }
         }

schemas/cloud.yml

@@ -80,6 +80,18 @@
 
         Examples: AWS account name, Google Cloud ORG display name.
 
+    - name: service.name
+      level: extended
+      type: keyword
+      example: lambda
+      short: The cloud service name.
+      description: >
+        The cloud service name is intended to distinguish services running on
+        different platforms within a provider, eg AWS EC2 vs Lambda,
+        GCP GCE vs App Engine, Azure VM vs App Server.
+
+        Examples: app engine, app service, cloud run, fargate, lambda.
+
     - name: project.id
       level: extended
       type: keyword