Entity subdomain doesn’t exist in top level domains

[trisch-me]

After recent changes (adding entity fieldset to the ECS ) we have following inconsistency for all affected groups (cloud, host, service, user). Let discuss check only user as an example:

RFC says that

If the entity type includes a provision for `target.*` fields, such as `user.target.*`, then the `entity.*` fields should be nested under the `*.target.*` field set, for example, `user.target.entity.*`. 

PR above adds entity sub namespace to the target but not to the namespace itself i.e. user.target has type of user namespace itself. So essentially it means target is of type user therefore we adding entity to the user namespace.

Changes required

Update yaml files to include entity to the top level namespace - user.entity, host.entity etc

cc @nick-alayil @MikePaquette @mjwolf

[nick-alayil]

Thanks @trisch-me for opening this ticket! I’ve documented the missing fields and a few related issues with the Entity FieldSet RFC from a graph visualization perspective here. That ticket covers multiple topics, but I believe this particular bug addresses two of the issues I mentioned there, specifically:

user.entity.* - Not listed in the generated ecs but assumed to follow pattern

service.entity.* - Not listed in the generated ecs but assumed to follow pattern

According to the field re-use section of the RFC:

If the entity type is one of host, user, service, cloud, orchestrator, then the entity fields should be nested under the respective root field set, for example host.entity.* , user.entity.*, etc.

Special note for use with entity fields that use target fields. If the entity type includes a provision for target.* fields, such as user.target., then the entity. fields should be nested under the .target. field set, for example, user.target.entity.*

So, just to confirm. We’ll have both user.entity.* and user.target.entity.* as per the RFC, which aligns with what’s needed for graph viz. I just want to double-check that we won’t be considering user.target.user.entity.*, since that’s treated as a special case.

[nick-alayil]

Let discuss check only user as an example

I understand you were using the user FieldSet just as an example in this ticket but I wanted to call out one related detail.

Entity subdomain doesn’t exist in top level domains

That’s not entirely accurate, since the entity subdomain already exists for the host FieldSet as part of the Entity RFC that was merged last month. You can see this here and also reflected in the generated ecs

[mjwolf]

The source of this problem was in trying to comply with the requirement from the RFC: Special note for use with entity fields that use target fields. If the entity type includes a provision for target.* fields, such as user.target.*, then the entity.* fields should be nested under the *.target.* field set, for example, user.target.entity.*. Which I took to mean "only nested under", so that since user.target exists, entity would only be nested at user.target.entity.

@nick-alayil I see from your linked ticket, entity can be both actor, at user.entity and target, at user.target.entity. Is that correct?

If it is, then this PR will fix both problems #2556. entity will be added to the top-level namespace, so it's correctly part of the user.target's user type, and be available to use as the actor at user.entity.

[nick-alayil]

@nick-alayil I see from your linked ticket, entity can be both actor, at user.entity and target, at user.target.entity. Is that correct?

Yes, that’s right.