From d1ac18ea1a7092247ea1fac909ffd2bfcdd9081d Mon Sep 17 00:00:00 2001
From: Mathieu Martin <mathieu.martin@elastic.co>
Date: Wed, 23 Jan 2019 13:40:54 -0500
Subject: [PATCH] Import user.group changes from ECS without regenerating.

Imports the hanges from https://github.com/elastic/ecs/pull/308.
---
 libbeat/_meta/fields.ecs.yml | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/libbeat/_meta/fields.ecs.yml b/libbeat/_meta/fields.ecs.yml
index 6dee0fbb0c3..90b705db0f1 100644
--- a/libbeat/_meta/fields.ecs.yml
+++ b/libbeat/_meta/fields.ecs.yml
@@ -2126,11 +2126,25 @@
             cannot be used.
     
         - name: group
-          level: extended
-          type: keyword
+          title: Group
+          group: 2
           description: >
-            Group the user is a part of. This field can contain a list of groups, if
-            necessary.
+            The group fields are meant to represent groups that are relevant to the
+            event.
+          type: group
+          fields:
+
+            - name: id
+              level: extended
+              type: keyword
+              description: >
+                Unique identifier for the group on the system/platform.
+
+            - name: name
+              level: extended
+              type: keyword
+              description: >
+                Name of the group.
     
     - name: user_agent
       title: User agent