diff --git a/CHANGELOG.next.md b/CHANGELOG.next.md index c922e4964..16f7020ea 100644 --- a/CHANGELOG.next.md +++ b/CHANGELOG.next.md @@ -39,6 +39,7 @@ Thanks, you're awesome :-) --> * Allow Unicode characters in generated ECS yml files. #2478 * Update semconv version used in file generation to v1.34.0 #2483 +* Added details for implementation of url.query to avoid ambiguity #2488 #### Deprecated diff --git a/docs/reference/ecs-url.md b/docs/reference/ecs-url.md index 0ec666f4f..853e054c3 100644 --- a/docs/reference/ecs-url.md +++ b/docs/reference/ecs-url.md @@ -23,7 +23,7 @@ URL fields provide support for complete or partial URLs, and supports the breaki | $$$field-url-password$$$ [url.password](#field-url-password) | Password of the request.

type: keyword | extended | | $$$field-url-path$$$ [url.path](#field-url-path) | Path of the request, such as "/search".

type: wildcard

![OTel Badge](https://img.shields.io/badge/OpenTelemetry-4a5ca6?style=flat&logo=opentelemetry) [![match](https://img.shields.io/badge/match-93c93e?style=flat)](/reference/ecs-opentelemetry.md#ecs-opentelemetry-relation) [url.path](https://opentelemetry.io/docs/specs/semconv/attributes-registry/url/#url-path) | extended | | $$$field-url-port$$$ [url.port](#field-url-port) | Port of the request, such as 443.

type: long

example: `443`

![OTel Badge](https://img.shields.io/badge/OpenTelemetry-4a5ca6?style=flat&logo=opentelemetry) [![match](https://img.shields.io/badge/match-93c93e?style=flat)](/reference/ecs-opentelemetry.md#ecs-opentelemetry-relation) [url.port](https://opentelemetry.io/docs/specs/semconv/attributes-registry/url/#url-port) | extended | -| $$$field-url-query$$$ [url.query](#field-url-query) | The query field describes the query string of the request, such as "q=elasticsearch".

The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.

type: keyword

![OTel Badge](https://img.shields.io/badge/OpenTelemetry-4a5ca6?style=flat&logo=opentelemetry) [![match](https://img.shields.io/badge/match-93c93e?style=flat)](/reference/ecs-opentelemetry.md#ecs-opentelemetry-relation) [url.query](https://opentelemetry.io/docs/specs/semconv/attributes-registry/url/#url-query) | extended | +| $$$field-url-query$$$ [url.query](#field-url-query) | The field contains the entire query string excluding the leading `?`.

The query field describes the query string of the request, such as "q=elasticsearch".

The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.

type: keyword

example: `q=elasticsearch&sort=desc`

![OTel Badge](https://img.shields.io/badge/OpenTelemetry-4a5ca6?style=flat&logo=opentelemetry) [![match](https://img.shields.io/badge/match-93c93e?style=flat)](/reference/ecs-opentelemetry.md#ecs-opentelemetry-relation) [url.query](https://opentelemetry.io/docs/specs/semconv/attributes-registry/url/#url-query) | extended | | $$$field-url-registered-domain$$$ [url.registered_domain](#field-url-registered-domain) | The highest registered url domain, stripped of the subdomain.

For example, the registered domain for "foo.example.com" is "example.com".

This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".

type: keyword

example: `example.com`

![OTel Badge](https://img.shields.io/badge/OpenTelemetry-4a5ca6?style=flat&logo=opentelemetry) [![match](https://img.shields.io/badge/match-93c93e?style=flat)](/reference/ecs-opentelemetry.md#ecs-opentelemetry-relation) [url.registered_domain](https://opentelemetry.io/docs/specs/semconv/attributes-registry/url/#url-registered-domain) | extended | | $$$field-url-scheme$$$ [url.scheme](#field-url-scheme) | Scheme of the request, such as "https".

Note: The `:` is not part of the scheme.

type: keyword

example: `https`

![OTel Badge](https://img.shields.io/badge/OpenTelemetry-4a5ca6?style=flat&logo=opentelemetry) [![match](https://img.shields.io/badge/match-93c93e?style=flat)](/reference/ecs-opentelemetry.md#ecs-opentelemetry-relation) [url.scheme](https://opentelemetry.io/docs/specs/semconv/attributes-registry/url/#url-scheme) | extended | | $$$field-url-subdomain$$$ [url.subdomain](#field-url-subdomain) | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.

For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.

type: keyword

example: `east`

![OTel Badge](https://img.shields.io/badge/OpenTelemetry-4a5ca6?style=flat&logo=opentelemetry) [![match](https://img.shields.io/badge/match-93c93e?style=flat)](/reference/ecs-opentelemetry.md#ecs-opentelemetry-relation) [url.subdomain](https://opentelemetry.io/docs/specs/semconv/attributes-registry/url/#url-subdomain) | extended | diff --git a/experimental/generated/beats/fields.ecs.yml b/experimental/generated/beats/fields.ecs.yml index 8f3d734ca..66815838c 100644 --- a/experimental/generated/beats/fields.ecs.yml +++ b/experimental/generated/beats/fields.ecs.yml @@ -10624,13 +10624,16 @@ level: extended type: keyword ignore_above: 2083 - description: 'The query field describes the query string of the request, such - as "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading + `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc default_field: false - name: enrichments.indicator.url.registered_domain level: extended @@ -12284,13 +12287,16 @@ level: extended type: keyword ignore_above: 2083 - description: 'The query field describes the query string of the request, such - as "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading + `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc default_field: false - name: indicator.url.registered_domain level: extended @@ -13353,13 +13359,16 @@ level: extended type: keyword ignore_above: 2083 - description: 'The query field describes the query string of the request, such - as "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading + `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc - name: registered_domain level: extended type: keyword diff --git a/experimental/generated/csv/fields.csv b/experimental/generated/csv/fields.csv index aae4a4343..a39201dcc 100644 --- a/experimental/generated/csv/fields.csv +++ b/experimental/generated/csv/fields.csv @@ -1361,7 +1361,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 9.1.0-dev+exp,true,threat,threat.enrichments.indicator.url.password,keyword,extended,,,Password of the request. 9.1.0-dev+exp,true,threat,threat.enrichments.indicator.url.path,wildcard,extended,,,"Path of the request, such as ""/search""." 9.1.0-dev+exp,true,threat,threat.enrichments.indicator.url.port,long,extended,,443,"Port of the request, such as 443." -9.1.0-dev+exp,true,threat,threat.enrichments.indicator.url.query,keyword,extended,,,Query string of the request. +9.1.0-dev+exp,true,threat,threat.enrichments.indicator.url.query,keyword,extended,,q=elasticsearch&sort=desc,Query string of the request. 9.1.0-dev+exp,true,threat,threat.enrichments.indicator.url.registered_domain,keyword,extended,,example.com,"The highest registered url domain, stripped of the subdomain." 9.1.0-dev+exp,true,threat,threat.enrichments.indicator.url.scheme,keyword,extended,,https,Scheme of the url. 9.1.0-dev+exp,true,threat,threat.enrichments.indicator.url.subdomain,keyword,extended,,east,The subdomain of the domain. @@ -1584,7 +1584,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 9.1.0-dev+exp,true,threat,threat.indicator.url.password,keyword,extended,,,Password of the request. 9.1.0-dev+exp,true,threat,threat.indicator.url.path,wildcard,extended,,,"Path of the request, such as ""/search""." 9.1.0-dev+exp,true,threat,threat.indicator.url.port,long,extended,,443,"Port of the request, such as 443." -9.1.0-dev+exp,true,threat,threat.indicator.url.query,keyword,extended,,,Query string of the request. +9.1.0-dev+exp,true,threat,threat.indicator.url.query,keyword,extended,,q=elasticsearch&sort=desc,Query string of the request. 9.1.0-dev+exp,true,threat,threat.indicator.url.registered_domain,keyword,extended,,example.com,"The highest registered url domain, stripped of the subdomain." 9.1.0-dev+exp,true,threat,threat.indicator.url.scheme,keyword,extended,,https,Scheme of the url. 9.1.0-dev+exp,true,threat,threat.indicator.url.subdomain,keyword,extended,,east,The subdomain of the domain. @@ -1720,7 +1720,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 9.1.0-dev+exp,true,url,url.password,keyword,extended,,,Password of the request. 9.1.0-dev+exp,true,url,url.path,wildcard,extended,,,"Path of the request, such as ""/search""." 9.1.0-dev+exp,true,url,url.port,long,extended,,443,"Port of the request, such as 443." -9.1.0-dev+exp,true,url,url.query,keyword,extended,,,Query string of the request. +9.1.0-dev+exp,true,url,url.query,keyword,extended,,q=elasticsearch&sort=desc,Query string of the request. 9.1.0-dev+exp,true,url,url.registered_domain,keyword,extended,,example.com,"The highest registered url domain, stripped of the subdomain." 9.1.0-dev+exp,true,url,url.scheme,keyword,extended,,https,Scheme of the url. 9.1.0-dev+exp,true,url,url.subdomain,keyword,extended,,east,The subdomain of the domain. diff --git a/experimental/generated/ecs/ecs_flat.yml b/experimental/generated/ecs/ecs_flat.yml index fdb9c6445..fad20e790 100644 --- a/experimental/generated/ecs/ecs_flat.yml +++ b/experimental/generated/ecs/ecs_flat.yml @@ -17748,13 +17748,15 @@ threat.enrichments.indicator.url.port: type: long threat.enrichments.indicator.url.query: dashed_name: threat-enrichments-indicator-url-query - description: 'The query field describes the query string of the request, such as - "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc flat_name: threat.enrichments.indicator.url.query ignore_above: 2083 level: extended @@ -20547,13 +20549,15 @@ threat.indicator.url.port: type: long threat.indicator.url.query: dashed_name: threat-indicator-url-query - description: 'The query field describes the query string of the request, such as - "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc flat_name: threat.indicator.url.query ignore_above: 2083 level: extended @@ -22390,13 +22394,15 @@ url.port: type: long url.query: dashed_name: url-query - description: 'The query field describes the query string of the request, such as - "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc flat_name: url.query ignore_above: 2083 level: extended diff --git a/experimental/generated/ecs/ecs_nested.yml b/experimental/generated/ecs/ecs_nested.yml index 423789847..76388039f 100644 --- a/experimental/generated/ecs/ecs_nested.yml +++ b/experimental/generated/ecs/ecs_nested.yml @@ -20516,13 +20516,16 @@ threat: type: long threat.enrichments.indicator.url.query: dashed_name: threat-enrichments-indicator-url-query - description: 'The query field describes the query string of the request, such - as "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading + `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc flat_name: threat.enrichments.indicator.url.query ignore_above: 2083 level: extended @@ -23323,13 +23326,16 @@ threat: type: long threat.indicator.url.query: dashed_name: threat-indicator-url-query - description: 'The query field describes the query string of the request, such - as "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading + `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc flat_name: threat.indicator.url.query ignore_above: 2083 level: extended @@ -25294,13 +25300,16 @@ url: type: long url.query: dashed_name: url-query - description: 'The query field describes the query string of the request, such - as "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading + `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc flat_name: url.query ignore_above: 2083 level: extended diff --git a/generated/beats/fields.ecs.yml b/generated/beats/fields.ecs.yml index c6e2a504c..d11915bb1 100644 --- a/generated/beats/fields.ecs.yml +++ b/generated/beats/fields.ecs.yml @@ -10574,13 +10574,16 @@ level: extended type: keyword ignore_above: 2083 - description: 'The query field describes the query string of the request, such - as "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading + `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc default_field: false - name: enrichments.indicator.url.registered_domain level: extended @@ -12234,13 +12237,16 @@ level: extended type: keyword ignore_above: 2083 - description: 'The query field describes the query string of the request, such - as "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading + `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc default_field: false - name: indicator.url.registered_domain level: extended @@ -13303,13 +13309,16 @@ level: extended type: keyword ignore_above: 2083 - description: 'The query field describes the query string of the request, such - as "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading + `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc - name: registered_domain level: extended type: keyword diff --git a/generated/csv/fields.csv b/generated/csv/fields.csv index 519398276..06b017331 100644 --- a/generated/csv/fields.csv +++ b/generated/csv/fields.csv @@ -1354,7 +1354,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 9.1.0-dev,true,threat,threat.enrichments.indicator.url.password,keyword,extended,,,Password of the request. 9.1.0-dev,true,threat,threat.enrichments.indicator.url.path,wildcard,extended,,,"Path of the request, such as ""/search""." 9.1.0-dev,true,threat,threat.enrichments.indicator.url.port,long,extended,,443,"Port of the request, such as 443." -9.1.0-dev,true,threat,threat.enrichments.indicator.url.query,keyword,extended,,,Query string of the request. +9.1.0-dev,true,threat,threat.enrichments.indicator.url.query,keyword,extended,,q=elasticsearch&sort=desc,Query string of the request. 9.1.0-dev,true,threat,threat.enrichments.indicator.url.registered_domain,keyword,extended,,example.com,"The highest registered url domain, stripped of the subdomain." 9.1.0-dev,true,threat,threat.enrichments.indicator.url.scheme,keyword,extended,,https,Scheme of the url. 9.1.0-dev,true,threat,threat.enrichments.indicator.url.subdomain,keyword,extended,,east,The subdomain of the domain. @@ -1577,7 +1577,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 9.1.0-dev,true,threat,threat.indicator.url.password,keyword,extended,,,Password of the request. 9.1.0-dev,true,threat,threat.indicator.url.path,wildcard,extended,,,"Path of the request, such as ""/search""." 9.1.0-dev,true,threat,threat.indicator.url.port,long,extended,,443,"Port of the request, such as 443." -9.1.0-dev,true,threat,threat.indicator.url.query,keyword,extended,,,Query string of the request. +9.1.0-dev,true,threat,threat.indicator.url.query,keyword,extended,,q=elasticsearch&sort=desc,Query string of the request. 9.1.0-dev,true,threat,threat.indicator.url.registered_domain,keyword,extended,,example.com,"The highest registered url domain, stripped of the subdomain." 9.1.0-dev,true,threat,threat.indicator.url.scheme,keyword,extended,,https,Scheme of the url. 9.1.0-dev,true,threat,threat.indicator.url.subdomain,keyword,extended,,east,The subdomain of the domain. @@ -1713,7 +1713,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 9.1.0-dev,true,url,url.password,keyword,extended,,,Password of the request. 9.1.0-dev,true,url,url.path,wildcard,extended,,,"Path of the request, such as ""/search""." 9.1.0-dev,true,url,url.port,long,extended,,443,"Port of the request, such as 443." -9.1.0-dev,true,url,url.query,keyword,extended,,,Query string of the request. +9.1.0-dev,true,url,url.query,keyword,extended,,q=elasticsearch&sort=desc,Query string of the request. 9.1.0-dev,true,url,url.registered_domain,keyword,extended,,example.com,"The highest registered url domain, stripped of the subdomain." 9.1.0-dev,true,url,url.scheme,keyword,extended,,https,Scheme of the url. 9.1.0-dev,true,url,url.subdomain,keyword,extended,,east,The subdomain of the domain. diff --git a/generated/ecs/ecs_flat.yml b/generated/ecs/ecs_flat.yml index 63e979ee2..4f227b899 100644 --- a/generated/ecs/ecs_flat.yml +++ b/generated/ecs/ecs_flat.yml @@ -17679,13 +17679,15 @@ threat.enrichments.indicator.url.port: type: long threat.enrichments.indicator.url.query: dashed_name: threat-enrichments-indicator-url-query - description: 'The query field describes the query string of the request, such as - "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc flat_name: threat.enrichments.indicator.url.query ignore_above: 2083 level: extended @@ -20478,13 +20480,15 @@ threat.indicator.url.port: type: long threat.indicator.url.query: dashed_name: threat-indicator-url-query - description: 'The query field describes the query string of the request, such as - "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc flat_name: threat.indicator.url.query ignore_above: 2083 level: extended @@ -22321,13 +22325,15 @@ url.port: type: long url.query: dashed_name: url-query - description: 'The query field describes the query string of the request, such as - "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc flat_name: url.query ignore_above: 2083 level: extended diff --git a/generated/ecs/ecs_nested.yml b/generated/ecs/ecs_nested.yml index 88ee5db66..55b133a96 100644 --- a/generated/ecs/ecs_nested.yml +++ b/generated/ecs/ecs_nested.yml @@ -20436,13 +20436,16 @@ threat: type: long threat.enrichments.indicator.url.query: dashed_name: threat-enrichments-indicator-url-query - description: 'The query field describes the query string of the request, such - as "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading + `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc flat_name: threat.enrichments.indicator.url.query ignore_above: 2083 level: extended @@ -23243,13 +23246,16 @@ threat: type: long threat.indicator.url.query: dashed_name: threat-indicator-url-query - description: 'The query field describes the query string of the request, such - as "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading + `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc flat_name: threat.indicator.url.query ignore_above: 2083 level: extended @@ -25214,13 +25220,16 @@ url: type: long url.query: dashed_name: url-query - description: 'The query field describes the query string of the request, such - as "q=elasticsearch". + description: 'The field contains the entire query string excluding the leading + `?`. + + The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.' + example: q=elasticsearch&sort=desc flat_name: url.query ignore_above: 2083 level: extended diff --git a/schemas/url.yml b/schemas/url.yml index 29941fed8..458940fd5 100644 --- a/schemas/url.yml +++ b/schemas/url.yml @@ -166,6 +166,8 @@ type: keyword short: Query string of the request. description: > + The field contains the entire query string excluding the leading `?`. + The query field describes the query string of the request, such as "q=elasticsearch". @@ -174,6 +176,7 @@ the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. ignore_above: 2083 + example: q=elasticsearch&sort=desc otel: - relation: match