Revises event.created and expands with event.start and event.end

README.md

@@ -174,6 +174,8 @@ The event fields are used for context information about the data itself.
 | <a name="event.version"></a>event.version  | The version field contains the version an event for ECS adheres to.<br/>This field should be provided as part of each event to make it possible to detect to which ECS version an event belongs.<br/>event.version is a required field and must exist in all events. It describes which ECS version the event adheres to.<br/>The current version is 0.1.0.  | keyword  |   | `0.1.0`  |
 | <a name="event.duration"></a>event.duration  | Duration of the event in nanoseconds.  | long  |   |   |
 | <a name="event.created"></a>event.created  | event.created contains the date when the event was created.<br/>This timestamp is distinct from @timestamp in that @timestamp contains the processed timestamp. For logs these two timestamps can be different as the timestamp in the log line and when the event is read for example by Filebeat are not identical. `@timestamp` must contain the timestamp extracted from the log line, event.created when the log line is read. The same could apply to package capturing where @timestamp contains the timestamp extracted from the network package and event.created when the event was created.<br/>In case the two timestamps are identical, @timestamp should be used.  | date  |   |   |
+| <a name="event.start"></a>event.start  | event.start contains the date when the event started.<br/>This timestamp is distinct from @timestamp in that @timestamp contains the processed timestamp. For logs these two timestamps can be different as the timestamp in the log line and when the event is read for example by Filebeat are not identical. `@timestamp` must contain the timestamp extracted from the log line, event.start when the log line is read. The same could apply to package capturing where @timestamp contains the timestamp extracted from the network package and event.created when the event was created.<br/>In case the two timestamps are identical, @timestamp should be used.  | date  |   |   |
+| <a name="event.end"></a>event.end  | event.end contains the date when the event ended.  | date  |   |   |
 | <a name="event.risk_score"></a>event.risk_score  | Risk score value of the event.  | float  |   |   |
 
 

schema.csv

@@ -42,12 +42,14 @@ event.category,keyword,0,metrics
 event.created,date,0,
 event.dataset,keyword,0,stats
 event.duration,long,0,
+event.end,date,0,
 event.hash,keyword,1,123456789012345678901234567890ABCD
 event.id,keyword,1,8a4f500d
 event.module,keyword,0,mysql
 event.raw,keyword,1,Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232
 event.risk_score,float,0,
 event.severity,long,1,7
+event.start,date,0,
 event.type,keyword,0,nginx-stats-metrics
 event.version,keyword,0,0.1.0
 file.ctime,date,0,

schemas/event.yml

@@ -128,6 +128,27 @@
 
         In case the two timestamps are identical, @timestamp should be used.
 
+    - name: start
+      type: date
+      description: >
+        event.start contains the date when the event started.
+
+        This timestamp is distinct from @timestamp in that @timestamp contains
+        the processed timestamp. For logs these two timestamps can be different
+        as the timestamp in the log line and when the event is read for example
+        by Filebeat are not identical. `@timestamp` must contain the timestamp
+        extracted from the log line, event.start when the log line is read.
+        The same could apply to package capturing where @timestamp contains the
+        timestamp extracted from the network package and event.created when the
+        event was created.
+
+        In case the two timestamps are identical, @timestamp should be used.
+
+    - name: end
+      type: date
+      description: >
+        event.end contains the date when the event ended.
+
     - name: risk_score
       type: float
       description: >

template.json

@@ -222,6 +222,9 @@
             "duration": {
               "type": "long"
             },
+            "end": {
+              "type": "date"
+            },
             "hash": {
               "ignore_above": 1024,
               "type": "keyword"
@@ -246,6 +249,9 @@
             "severity": {
               "type": "long"
             },
+            "start": {
+              "type": "date"
+            },
             "type": {
               "ignore_above": 1024,
               "type": "keyword"
@@ -655,6 +661,7 @@
           "properties": {
             "certificates": {
               "doc_values": false,
+              "ignore_above": 1024,
               "type": "keyword"
             },
             "ciphersuite": {