Add host.serial_number

[andrewthad]

Summary

Add a field host.serial_number, which is like observer.serial_number, but it refers to the serial number of a host from which metrics were taken, not to an observer (observer basically means firewall in ECS).

Motivation:

Universal power supplies, switches, sensors, etc. have serial numbers. It would be good to have a place to put this information.

[ebeahan]

Hey, @andrewthad! I agree this would be a good addition.

There's been discussion introducing additional fields or even a new field set to support asset and configuration management use cases better. Before adding host.serial_number, I think it'd be best to have the larger strategy better-formed first.

Something like asset.serial_number might be a better place for tracking attributes of more assets/inventory, including ones that don't fall into the current ECS definition of a computing host.* (power supplies, electrical equipment, sensors, etc.).

[djptek]

Something like asset.serial_number might be a better place for tracking attributes of more assets/inventory, including ones that don't fall into the current ECS definition of a computing host.* (power supplies, electrical equipment, sensors, etc.).

given that not all assets have serial numbers, perhaps

asset.uid
asset.unique_id

or

asset.handle

might be more generic

[LaZyDK]

I would also like host.serial_number to be included for asset management purposes.