Merge branch 'main' into dependabot/pip/scripts/jinja2-3.1.3

.github/workflows/docs-preview-comment.yml

@@ -15,7 +15,7 @@ jobs:
         with:
           script: |
             const pr = context.payload.pull_request;
-            const comment = `Documentation changes preview: https://${context.repo.repo}_${pr.number}.docs-preview.app.elstc.co/diff`;
+            const comment = `Documentation changes preview: https://${context.repo.repo}_bk_${pr.number}.docs-preview.app.elstc.co/diff`;
 
             github.rest.issues.createComment({
               issue_number: context.issue.number,

CHANGELOG.next.md

@@ -17,6 +17,8 @@ Thanks, you're awesome :-) -->
 #### Added
 
 * Added `volume.*` as beta field set. #2269
+* Advanced `process.env_vars` to GA. #2315
+* Advanced `process.io` and `process.tty` fields to GA. #2317
 
 #### Improvements
 

CONTRIBUTING.md

@@ -99,19 +99,10 @@ Please follow these guidelines when submitting Issues:
 
 ## Feature freezes and branching
 
-ECS follows a two-stage feature freeze approach using the concepts of Soft Feature Freezes (SFF) and Hard Feature Freezes (HFF).
+For an upcoming release, ECS uses a feature freeze (FF) approach. A release branch is cut from `main` for an upcoming
+release. When a branch is frozen, changes are limited to bug fixes or doc updates.
 
-Once a branch enters SFF, only minor and low-impact features can be added. The ECS team will rely on the “scope of impact” assessment in the ECS RFC process to help assess the potential impact of a proposed change.
-
-When a branch enters HFF, from that point onward all new features of any size must be contributed to the next ECS version.
-
-For people contributing to the ECS repo, this change means there are two branches at any given time that are accepting at least some sort of feature changes. Here's an example using ECS 8.1:
-
-| Branch | Version | Change scope |
-| ------ | ------- | ------------ |
-| `main`  | 8.2    | Any enhancements or otherwise |
-| `8.1`   | 8.1    | SFF: Can have low impact enhancements |
-| `8.0`   | 8.0    | HFF: Only bug fixes, tooling, docs, etc |
+Any schema changes or tooling updates will be merged into `main` for the next ECS version.
 
 ### Changelogs
 
@@ -222,6 +213,12 @@ The [schemas](schemas) directory contains the files which define the Elastic Com
 
 Users consuming ECS to generate something for other use cases should use the `generated/ecs/*.yml` files. More detail can be found [here](generated/README.md).
 
+### Subset Files
+
+The [schemas/subsets](schemas/subsets/) directory contains the configuration to control advanced field nesting use cases.
+The config is used with the `--subset` option to control which field sets or specific fields appear in the final generated
+artifacts.
+
 ## Additional Resources
 
 * [ECS Guidelines and Best Practices](https://www.elastic.co/guide/en/ecs/current/ecs-guidelines.html)

docs/fields/field-details.asciidoc

@@ -8101,9 +8101,7 @@ type: keyword
 [[field-process-env-vars]]
 <<field-process-env-vars, process.env_vars>>
 
-a| beta:[ This field is beta and subject to change. ]
-
-Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.
+a| Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.
 
 May be filtered to protect sensitive information.
 
@@ -8184,9 +8182,7 @@ example: `True`
 [[field-process-io]]
 <<field-process-io, process.io>>
 
-a| beta:[ This field is beta and subject to change. ]
-
-A chunk of input or output (IO) from a single process.
+a| A chunk of input or output (IO) from a single process.
 
 This field only appears on the top level process object, which is the process that wrote the output or read the input.
 
@@ -8204,9 +8200,7 @@ type: object
 [[field-process-io-bytes-skipped]]
 <<field-process-io-bytes-skipped, process.io.bytes_skipped>>
 
-a| beta:[ This field is beta and subject to change. ]
-
-An array of byte offsets and lengths denoting where IO data has been skipped.
+a| An array of byte offsets and lengths denoting where IO data has been skipped.
 
 type: object
 
@@ -8225,9 +8219,7 @@ Note: this field should contain an array of values.
 [[field-process-io-bytes-skipped-length]]
 <<field-process-io-bytes-skipped-length, process.io.bytes_skipped.length>>
 
-a| beta:[ This field is beta and subject to change. ]
-
-The length of bytes skipped.
+a| The length of bytes skipped.
 
 type: long
 
@@ -8243,9 +8235,7 @@ type: long
 [[field-process-io-bytes-skipped-offset]]
 <<field-process-io-bytes-skipped-offset, process.io.bytes_skipped.offset>>
 
-a| beta:[ This field is beta and subject to change. ]
-
-The byte offset into this event's io.text (or io.bytes in the future) where length bytes were skipped.
+a| The byte offset into this event's io.text (or io.bytes in the future) where length bytes were skipped.
 
 type: long
 
@@ -8261,9 +8251,7 @@ type: long
 [[field-process-io-max-bytes-per-process-exceeded]]
 <<field-process-io-max-bytes-per-process-exceeded, process.io.max_bytes_per_process_exceeded>>
 
-a| beta:[ This field is beta and subject to change. ]
-
-If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.
+a| If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.
 
 type: boolean
 
@@ -8279,9 +8267,7 @@ type: boolean
 [[field-process-io-text]]
 <<field-process-io-text, process.io.text>>
 
-a| beta:[ This field is beta and subject to change. ]
-
-A chunk of output or input sanitized to UTF-8.
+a| A chunk of output or input sanitized to UTF-8.
 
 Best efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word.
 
@@ -8299,9 +8285,7 @@ type: wildcard
 [[field-process-io-total-bytes-captured]]
 <<field-process-io-total-bytes-captured, process.io.total_bytes_captured>>
 
-a| beta:[ This field is beta and subject to change. ]
-
-The total number of bytes captured in this event.
+a| The total number of bytes captured in this event.
 
 type: long
 
@@ -8317,9 +8301,7 @@ type: long
 [[field-process-io-total-bytes-skipped]]
 <<field-process-io-total-bytes-skipped, process.io.total_bytes_skipped>>
 
-a| beta:[ This field is beta and subject to change. ]
-
-The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero
+a| The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero
 
 type: long
 
@@ -8335,9 +8317,7 @@ type: long
 [[field-process-io-type]]
 <<field-process-io-type, process.io.type>>
 
-a| beta:[ This field is beta and subject to change. ]
-
-The type of object on which the IO action (read or write) was taken.
+a| The type of object on which the IO action (read or write) was taken.
 
 Currently only 'tty' is supported. Other types may be added in the future for 'file' and 'socket' support.
 
@@ -8595,9 +8575,7 @@ example: `1`
 [[field-process-tty-columns]]
 <<field-process-tty-columns, process.tty.columns>>
 
-a| beta:[ This field is beta and subject to change. ]
-
-The number of character columns per line. e.g terminal width
+a| The number of character columns per line. e.g terminal width
 
 Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'
 
@@ -8615,9 +8593,7 @@ example: `80`
 [[field-process-tty-rows]]
 <<field-process-tty-rows, process.tty.rows>>
 
-a| beta:[ This field is beta and subject to change. ]
-
-The number of character rows in the terminal. e.g terminal height
+a| The number of character rows in the terminal. e.g terminal height
 
 Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'
 

experimental/generated/ecs/ecs_flat.yml

@@ -8888,7 +8888,6 @@ process.entry_leader.working_directory:
   short: The working directory of the process.
   type: keyword
 process.env_vars:
-  beta: This field is beta and subject to change.
   dashed_name: process-env-vars
   description: 'Array of environment variable bindings. Captured from a snapshot of
     the environment at the time of execution.
@@ -9449,7 +9448,6 @@ process.interactive:
   short: Whether the process is connected to an interactive shell.
   type: boolean
 process.io:
-  beta: This field is beta and subject to change.
   dashed_name: process-io
   description: 'A chunk of input or output (IO) from a single process.
 
@@ -9462,7 +9460,6 @@ process.io:
   short: A chunk of input or output (IO) from a single process.
   type: object
 process.io.bytes_skipped:
-  beta: This field is beta and subject to change.
   dashed_name: process-io-bytes-skipped
   description: An array of byte offsets and lengths denoting where IO data has been
     skipped.
@@ -9474,7 +9471,6 @@ process.io.bytes_skipped:
   short: An array of byte offsets and lengths denoting where IO data has been skipped.
   type: object
 process.io.bytes_skipped.length:
-  beta: This field is beta and subject to change.
   dashed_name: process-io-bytes-skipped-length
   description: The length of bytes skipped.
   flat_name: process.io.bytes_skipped.length
@@ -9484,7 +9480,6 @@ process.io.bytes_skipped.length:
   short: The length of bytes skipped.
   type: long
 process.io.bytes_skipped.offset:
-  beta: This field is beta and subject to change.
   dashed_name: process-io-bytes-skipped-offset
   description: The byte offset into this event's io.text (or io.bytes in the future)
     where length bytes were skipped.
@@ -9496,7 +9491,6 @@ process.io.bytes_skipped.offset:
     length bytes were skipped.
   type: long
 process.io.max_bytes_per_process_exceeded:
-  beta: This field is beta and subject to change.
   dashed_name: process-io-max-bytes-per-process-exceeded
   description: If true, the process producing the output has exceeded the max_kilobytes_per_process
     configuration setting.
@@ -9508,7 +9502,6 @@ process.io.max_bytes_per_process_exceeded:
     configuration setting.
   type: boolean
 process.io.text:
-  beta: This field is beta and subject to change.
   dashed_name: process-io-text
   description: 'A chunk of output or input sanitized to UTF-8.
 
@@ -9523,7 +9516,6 @@ process.io.text:
   short: A chunk of output or input sanitized to UTF-8.
   type: wildcard
 process.io.total_bytes_captured:
-  beta: This field is beta and subject to change.
   dashed_name: process-io-total-bytes-captured
   description: The total number of bytes captured in this event.
   flat_name: process.io.total_bytes_captured
@@ -9533,7 +9525,6 @@ process.io.total_bytes_captured:
   short: The total number of bytes captured in this event.
   type: long
 process.io.total_bytes_skipped:
-  beta: This field is beta and subject to change.
   dashed_name: process-io-total-bytes-skipped
   description: The total number of bytes that were not captured due to implementation
     restrictions such as buffer size limits. Implementors should strive to ensure
@@ -9546,7 +9537,6 @@ process.io.total_bytes_skipped:
     such as buffer size limits.
   type: long
 process.io.type:
-  beta: This field is beta and subject to change.
   dashed_name: process-io-type
   description: 'The type of object on which the IO action (read or write) was taken.
 
@@ -12603,7 +12593,6 @@ process.tty.char_device.minor:
   short: The TTY character device's minor number.
   type: long
 process.tty.columns:
-  beta: This field is beta and subject to change.
   dashed_name: process-tty-columns
   description: 'The number of character columns per line. e.g terminal width
 
@@ -12617,7 +12606,6 @@ process.tty.columns:
   short: The number of character columns per line. e.g terminal width
   type: long
 process.tty.rows:
-  beta: This field is beta and subject to change.
   dashed_name: process-tty-rows
   description: 'The number of character rows in the terminal. e.g terminal height
 

experimental/generated/ecs/ecs_nested.yml

@@ -11098,7 +11098,6 @@ process:
       short: The working directory of the process.
       type: keyword
     process.env_vars:
-      beta: This field is beta and subject to change.
       dashed_name: process-env-vars
       description: 'Array of environment variable bindings. Captured from a snapshot
         of the environment at the time of execution.
@@ -11659,7 +11658,6 @@ process:
       short: Whether the process is connected to an interactive shell.
       type: boolean
     process.io:
-      beta: This field is beta and subject to change.
       dashed_name: process-io
       description: 'A chunk of input or output (IO) from a single process.
 
@@ -11672,7 +11670,6 @@ process:
       short: A chunk of input or output (IO) from a single process.
       type: object
     process.io.bytes_skipped:
-      beta: This field is beta and subject to change.
       dashed_name: process-io-bytes-skipped
       description: An array of byte offsets and lengths denoting where IO data has
         been skipped.
@@ -11685,7 +11682,6 @@ process:
         skipped.
       type: object
     process.io.bytes_skipped.length:
-      beta: This field is beta and subject to change.
       dashed_name: process-io-bytes-skipped-length
       description: The length of bytes skipped.
       flat_name: process.io.bytes_skipped.length
@@ -11695,7 +11691,6 @@ process:
       short: The length of bytes skipped.
       type: long
     process.io.bytes_skipped.offset:
-      beta: This field is beta and subject to change.
       dashed_name: process-io-bytes-skipped-offset
       description: The byte offset into this event's io.text (or io.bytes in the future)
         where length bytes were skipped.
@@ -11707,7 +11702,6 @@ process:
         where length bytes were skipped.
       type: long
     process.io.max_bytes_per_process_exceeded:
-      beta: This field is beta and subject to change.
       dashed_name: process-io-max-bytes-per-process-exceeded
       description: If true, the process producing the output has exceeded the max_kilobytes_per_process
         configuration setting.
@@ -11719,7 +11713,6 @@ process:
         configuration setting.
       type: boolean
     process.io.text:
-      beta: This field is beta and subject to change.
       dashed_name: process-io-text
       description: 'A chunk of output or input sanitized to UTF-8.
 
@@ -11735,7 +11728,6 @@ process:
       short: A chunk of output or input sanitized to UTF-8.
       type: wildcard
     process.io.total_bytes_captured:
-      beta: This field is beta and subject to change.
       dashed_name: process-io-total-bytes-captured
       description: The total number of bytes captured in this event.
       flat_name: process.io.total_bytes_captured
@@ -11745,7 +11737,6 @@ process:
       short: The total number of bytes captured in this event.
       type: long
     process.io.total_bytes_skipped:
-      beta: This field is beta and subject to change.
       dashed_name: process-io-total-bytes-skipped
       description: The total number of bytes that were not captured due to implementation
         restrictions such as buffer size limits. Implementors should strive to ensure
@@ -11758,7 +11749,6 @@ process:
         restrictions such as buffer size limits.
       type: long
     process.io.type:
-      beta: This field is beta and subject to change.
       dashed_name: process-io-type
       description: 'The type of object on which the IO action (read or write) was
         taken.
@@ -14821,7 +14811,6 @@ process:
       short: The TTY character device's minor number.
       type: long
     process.tty.columns:
-      beta: This field is beta and subject to change.
       dashed_name: process-tty-columns
       description: 'The number of character columns per line. e.g terminal width
 
@@ -14835,7 +14824,6 @@ process:
       short: The number of character columns per line. e.g terminal width
       type: long
     process.tty.rows:
-      beta: This field is beta and subject to change.
       dashed_name: process-tty-rows
       description: 'The number of character rows in the terminal. e.g terminal height