Metadata Field Mapping

This table maps old metadata field names to New-Scale field names that correspond to the Common Information Model.

Old Metadata Field Name	New-Scale Metadata Field Name
@host	m_host
@metadata.beat	m_metadata_beat
@metadata.topic	m_metadata_topic
@metadata.type	m_metadata_type
@metadata.version	m_metadata_version
@timestamp	m_timestamp
@version	m_version
agent.ephemeral_id	m_agent_ephemeral_id
agent.hostname	m_agent_hostname
agent.id	m_agent_id
agent.type	m_agent_type
agent.version	m_agent_version
beat_name	m_beat_name
beat_version	m_beat_version
collector_name	m_collector_name
collector_type	m_collector_type
computer_name	m_computer_name
destinationServiceName	m_destinationServiceName
dproc	m_dproc
event.action	m_event_action
event.code	m_event_code
event.created	m_event_created
event.kind	m_event_kind
event.original	m_event_original
event.provider	m_event_provider
event_data.PackageName	m_event_data_PackageName
event_data.Status	m_event_data_Status
event_data.TargetUserName	m_event_data_TargetUserName
event_data.Workstation	m_event_data_Workstation
event_id	m_event_id
exa-message-size	m_exa_message_size
exa_rsc.agent.ephemeral_id	m_exa_rsc_agent_ephemeral_id
exa_rsc.agent.hostname	m_exa_rsc_agent_hostname
exa_rsc.agent.id	m_exa_rsc_agent_id
exa_rsc.agent.type	m_exa_rsc_agent_type
exa_rsc.agent.version	m_exa_rsc_agent_version
exa_rsc.hostname	m_exa_rsc_hostname
exa_rsc.input.type	m_exa_rsc_input_type
exa_rsc.kafka.headers	m_exa_rsc_kafka_headers
exa_rsc.kafka.key	m_exa_rsc_kafka_key
exa_rsc.kafka.offset	m_exa_rsc_kafka_offset
exa_rsc.kafka.partition	m_exa_rsc_kafka_partition
exa_rsc.kafka.topic	m_exa_rsc_kafka_topic
exa_rsc.time_off	m_exa_rsc_time_off
exa_rsc.timestamp	m_exa_rsc_timestamp
exa_rsc.timezone	m_exa_rsc_timezone
exa_sc.collector_name	m_exa_sc_collector_name
exa_sc.collector_type	m_exa_sc_collector_type
exa_sc.hostname	m_exa_sc_hostname
forwarder	m_forwarder
hostname	m_hostname
input.type	m_input_type
keywords	m_keywords
level	m_level
log.file.path	m_log_file_path
log.level	m_log_level
log.name	m_log_name
log.offset	m_log_offset
message	m_message
opcode	m_opcode
path	m_path
port	m_port
provider_guid	m_provider_guid
record.number	m_record_number
source.name	m_source_name
task	m_task
time_off	m_time_off
timezone	m_timezone
type	m_type
winlog.activity_id	m_winlog_activity_id
winlog.api	m_winlog_api
winlog.channel	m_winlog_channel
winlog.computer_name	m_winlog_computer_name
winlog.event_data.Binary	m_winlog_event_data_Binary
winlog.event_data.LogonType	m_winlog_event_data_LogonType
winlog.event_data.PrivilegeList	m_winlog_event_data_PrivilegeList
winlog.event_data.SubjectDomainName	m_winlog_event_data_SubjectDomainName
winlog.event_data.TargetDomainName	m_winlog_event_data_TargetDomainName
winlog.event_data.TargetLogonId	m_winlog_event_data_TargetLogonId
winlog.event_data.TargetUserName	m_winlog_event_data_TargetUserName
winlog.event_data.TargetUserSid	m_winlog_event_data_TargetUserSid
winlog.event_data.lmpackagename	m_winlog_event_data_lmpackagename
winlog.event_data.param1	m_winlog_event_data_param1
winlog.event_data.param2	m_winlog_event_data_param2
winlog.event_data.param3	m_winlog_event_data_param3
winlog.event_id	m_winlog_event_id
winlog.keywords	m_winlog_keywords
winlog.opcode	m_winlog_opcode
winlog.process.pid	m_winlog_process_pid
winlog.process.thread.id	m_winlog_process_thread_id
winlog.provider_guid	m_winlog_provider_guid
winlog.provider_name	m_winlog_provider_name
winlog.record_id	m_winlog_record_id
winlog.task	m_winlog_task
winlog.user.domain	m_winlog_user_domain
winlog.user.identifier	m_winlog_user_identifier
winlog.user.name	m_winlog_user_name
winlog.user.type	m_winlog_user_type