Skip to content

[9.4] Add mappings for process and security event sources metrics #763

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nicholasberlin wants to merge 2 commits into
base: 9.4
Choose a base branch
from
+264 −2
Open

[9.4] Add mappings for process and security event sources metrics #763

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f5de465
Add mappings for process and security event sources metrics
nicholasberlin Jul 10, 2026
659b07f
Add sources arrays to metrics sample_event.json
nicholasberlin Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 60 additions & 0 deletions custom_schemas/custom_endpoint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -570,6 +570,36 @@
type: long
description: Total size of suppressed documents

- name: metrics.documents_volume.process_events.sources
level: custom
type: object
description: An array of Process Event document statistics per source

- name: metrics.documents_volume.process_events.sources.source
level: custom
type: keyword
description: Process Event document source name

- name: metrics.documents_volume.process_events.sources.sent_count
level: custom
type: long
description: Number of sent Process Event documents from source

- name: metrics.documents_volume.process_events.sources.sent_bytes
level: custom
type: long
description: Total size of Process Event sent documents from source

- name: metrics.documents_volume.process_events.sources.suppressed_count
level: custom
type: long
description: Number of suppressed Process Event documents from source

- name: metrics.documents_volume.process_events.sources.suppressed_bytes
level: custom
type: long
description: Total size of suppressed Process Event documents from source

- name: metrics.documents_volume.library_events.sent_count
level: custom
type: long
Expand Down Expand Up @@ -610,6 +640,36 @@
type: long
description: Total size of suppressed documents

- name: metrics.documents_volume.security_events.sources
level: custom
type: object
description: An array of Security Event document statistics per source

- name: metrics.documents_volume.security_events.sources.source
level: custom
type: keyword
description: Security Event document source name

- name: metrics.documents_volume.security_events.sources.sent_count
level: custom
type: long
description: Number of sent Security Event documents from source

- name: metrics.documents_volume.security_events.sources.sent_bytes
level: custom
type: long
description: Total size of Security Event sent documents from source

- name: metrics.documents_volume.security_events.sources.suppressed_count
level: custom
type: long
description: Number of suppressed Security Event documents from source

- name: metrics.documents_volume.security_events.sources.suppressed_bytes
level: custom
type: long
description: Total size of suppressed Security Event documents from source

- name: metrics.documents_volume.dns_events.sent_count
level: custom
type: long
Expand Down
62 changes: 62 additions & 0 deletions package/endpoint/data_stream/metrics/fields/fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -303,6 +303,37 @@
type: long
description: Number of sent documents
default_field: false
- name: metrics.documents_volume.process_events.sources
level: custom
type: object
description: An array of Process Event document statistics per source
default_field: false
- name: metrics.documents_volume.process_events.sources.sent_bytes
level: custom
type: long
description: Total size of Process Event sent documents from source
default_field: false
- name: metrics.documents_volume.process_events.sources.sent_count
level: custom
type: long
description: Number of sent Process Event documents from source
default_field: false
- name: metrics.documents_volume.process_events.sources.source
level: custom
type: keyword
ignore_above: 1024
description: Process Event document source name
default_field: false
- name: metrics.documents_volume.process_events.sources.suppressed_bytes
level: custom
type: long
description: Total size of suppressed Process Event documents from source
default_field: false
- name: metrics.documents_volume.process_events.sources.suppressed_count
level: custom
type: long
description: Number of suppressed Process Event documents from source
default_field: false
- name: metrics.documents_volume.process_events.suppressed_bytes
level: custom
type: long
Expand Down Expand Up @@ -343,6 +374,37 @@
type: long
description: Number of sent documents
default_field: false
- name: metrics.documents_volume.security_events.sources
level: custom
type: object
description: An array of Security Event document statistics per source
default_field: false
- name: metrics.documents_volume.security_events.sources.sent_bytes
level: custom
type: long
description: Total size of Security Event sent documents from source
default_field: false
- name: metrics.documents_volume.security_events.sources.sent_count
level: custom
type: long
description: Number of sent Security Event documents from source
default_field: false
- name: metrics.documents_volume.security_events.sources.source
level: custom
type: keyword
ignore_above: 1024
description: Security Event document source name
default_field: false
- name: metrics.documents_volume.security_events.sources.suppressed_bytes
level: custom
type: long
description: Total size of suppressed Security Event documents from source
default_field: false
- name: metrics.documents_volume.security_events.sources.suppressed_count
level: custom
type: long
description: Number of suppressed Security Event documents from source
default_field: false
- name: metrics.documents_volume.security_events.suppressed_bytes
level: custom
type: long
Expand Down
22 changes: 20 additions & 2 deletions package/endpoint/data_stream/metrics/sample_event.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -664,7 +664,16 @@
"suppressed_count": 0,
"suppressed_bytes": 0,
"sent_count": 259,
"sent_bytes": 422247
"sent_bytes": 422247,
"sources": [
{
"source": "diagnostic_4624",
"sent_count": 4,
"sent_bytes": 10240,
"suppressed_count": 0,
"suppressed_bytes": 0
}
]
},
"library_events": {
"suppressed_count": 0,
Expand All @@ -676,7 +685,16 @@
"suppressed_count": 0,
"suppressed_bytes": 0,
"sent_count": 201,
"sent_bytes": 602914
"sent_bytes": 602914,
"sources": [
{
"source": "load_module",
"sent_count": 2,
"sent_bytes": 5000,
"suppressed_count": 1,
"suppressed_bytes": 2500
}
]
},
"registry_events": {
"suppressed_count": 0,
Expand Down
12 changes: 12 additions & 0 deletions package/endpoint/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3214,6 +3214,12 @@ Metrics documents contain performance information about the endpoint executable
| Endpoint.metrics.documents_volume.overall.suppressed_count | Number of suppressed documents | long |
| Endpoint.metrics.documents_volume.process_events.sent_bytes | Total size of sent documents | long |
| Endpoint.metrics.documents_volume.process_events.sent_count | Number of sent documents | long |
| Endpoint.metrics.documents_volume.process_events.sources | An array of Process Event document statistics per source | object |
| Endpoint.metrics.documents_volume.process_events.sources.sent_bytes | Total size of Process Event sent documents from source | long |
| Endpoint.metrics.documents_volume.process_events.sources.sent_count | Number of sent Process Event documents from source | long |
| Endpoint.metrics.documents_volume.process_events.sources.source | Process Event document source name | keyword |
| Endpoint.metrics.documents_volume.process_events.sources.suppressed_bytes | Total size of suppressed Process Event documents from source | long |
| Endpoint.metrics.documents_volume.process_events.sources.suppressed_count | Number of suppressed Process Event documents from source | long |
| Endpoint.metrics.documents_volume.process_events.suppressed_bytes | Total size of suppressed documents | long |
| Endpoint.metrics.documents_volume.process_events.suppressed_count | Number of suppressed documents | long |
| Endpoint.metrics.documents_volume.registry_events.sent_bytes | Total size of sent documents | long |
Expand All @@ -3222,6 +3228,12 @@ Metrics documents contain performance information about the endpoint executable
| Endpoint.metrics.documents_volume.registry_events.suppressed_count | Number of suppressed documents | long |
| Endpoint.metrics.documents_volume.security_events.sent_bytes | Total size of sent documents | long |
| Endpoint.metrics.documents_volume.security_events.sent_count | Number of sent documents | long |
| Endpoint.metrics.documents_volume.security_events.sources | An array of Security Event document statistics per source | object |
| Endpoint.metrics.documents_volume.security_events.sources.sent_bytes | Total size of Security Event sent documents from source | long |
| Endpoint.metrics.documents_volume.security_events.sources.sent_count | Number of sent Security Event documents from source | long |
| Endpoint.metrics.documents_volume.security_events.sources.source | Security Event document source name | keyword |
| Endpoint.metrics.documents_volume.security_events.sources.suppressed_bytes | Total size of suppressed Security Event documents from source | long |
| Endpoint.metrics.documents_volume.security_events.sources.suppressed_count | Number of suppressed Security Event documents from source | long |
| Endpoint.metrics.documents_volume.security_events.suppressed_bytes | Total size of suppressed documents | long |
| Endpoint.metrics.documents_volume.security_events.suppressed_count | Number of suppressed documents | long |
| Endpoint.metrics.event_filter.active_global_count | The number of active global event filters | long |
Expand Down
110 changes: 110 additions & 0 deletions schemas/v1/metrics/metrics.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.