Import user.group changes from ECS without regenerating.

Imports the hanges from elastic/ecs#308.
webmat · Jan 24, 2019 · d1ac18e · d1ac18e
1 parent 93cf5ed
commit d1ac18e
Showing 1 changed file with 18 additions and 4 deletions.
diff --git a/libbeat/_meta/fields.ecs.yml b/libbeat/_meta/fields.ecs.yml
@@ -2126,11 +2126,25 @@
             cannot be used.
 
         - name: group
-          level: extended
-          type: keyword
+          title: Group
+          group: 2
           description: >
-            Group the user is a part of. This field can contain a list of groups, if
-            necessary.
+            The group fields are meant to represent groups that are relevant to the
+            event.
+          type: group
+          fields:
+
+            - name: id
+              level: extended
+              type: keyword
+              description: >
+                Unique identifier for the group on the system/platform.
+
+            - name: name
+              level: extended
+              type: keyword
+              description: >
+                Name of the group.
     
     - name: user_agent
       title: User agent