diff --git a/ecs/states-inventory-packages/fields/custom/agent.yml b/ecs/states-inventory-packages/fields/custom/agent.yml new file mode 100644 index 0000000000000..3482123af637a --- /dev/null +++ b/ecs/states-inventory-packages/fields/custom/agent.yml @@ -0,0 +1,12 @@ +--- +- name: agent + title: Wazuh Agents + short: Wazuh Inc. custom fields. + type: group + group: 2 + fields: + - name: groups + type: keyword + level: custom + description: > + The groups the agent belongs to. diff --git a/ecs/states-inventory-packages/fields/mapping-settings.json b/ecs/states-inventory-packages/fields/mapping-settings.json new file mode 100644 index 0000000000000..0ad2b48fcc1be --- /dev/null +++ b/ecs/states-inventory-packages/fields/mapping-settings.json @@ -0,0 +1,4 @@ +{ + "dynamic": "strict", + "date_detection": false +} \ No newline at end of file diff --git a/ecs/states-inventory-packages/fields/subset.yml b/ecs/states-inventory-packages/fields/subset.yml new file mode 100644 index 0000000000000..49028288fea80 --- /dev/null +++ b/ecs/states-inventory-packages/fields/subset.yml @@ -0,0 +1,21 @@ +--- +name: wazuh-states-inventory-packages +fields: + base: + fields: + "@timestamp": {} + tags: [] + agent: + fields: + id: {} + groups: {} + package: + fields: + architecture: "" + description: "" + installed: {} + name: "" + path: "" + size: {} + type: "" + version: "" diff --git a/ecs/states-inventory-packages/fields/template-settings-legacy.json b/ecs/states-inventory-packages/fields/template-settings-legacy.json new file mode 100644 index 0000000000000..ca085a0dad45d --- /dev/null +++ b/ecs/states-inventory-packages/fields/template-settings-legacy.json @@ -0,0 +1,19 @@ +{ + "index_patterns": ["wazuh-states-inventory-packages*"], + "order": 1, + "settings": { + "index": { + "number_of_shards": "1", + "number_of_replicas": "0", + "refresh_interval": "5s", + "query.default_field": [ + "agent.id", + "agent.groups", + "package.architecture", + "package.name", + "package.version", + "package.type" + ] + } + } +} diff --git a/ecs/states-inventory-packages/fields/template-settings.json b/ecs/states-inventory-packages/fields/template-settings.json new file mode 100644 index 0000000000000..e6cd3078a8325 --- /dev/null +++ b/ecs/states-inventory-packages/fields/template-settings.json @@ -0,0 +1,21 @@ +{ + "index_patterns": ["wazuh-states-inventory-packages*"], + "priority": 1, + "template": { + "settings": { + "index": { + "number_of_shards": "1", + "number_of_replicas": "0", + "refresh_interval": "5s", + "query.default_field": [ + "agent.id", + "agent.groups", + "package.architecture", + "package.name", + "package.version", + "package.type" + ] + } + } + } +}