Container fields
Container fields are used for meta information about the specific container that is the source of information.
These fields help correlate data based containers from any runtime.
| Field | Description | Level |
|---|---|---|
| container.cpu.usage | Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1. Scaling factor: 1000. type: scaled_float   container.cpu.usage |
extended |
| container.disk.read.bytes | The total number of bytes (gauge) read successfully (aggregated from all disks) since the last metric collection. type: long |
extended |
| container.disk.write.bytes | The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection. type: long |
extended |
| container.id | Unique container id. type: keyword  container.id |
core |
| container.image.hash.all | An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: algorithm:value. Algorithm names should align with the field names in the ECS hash field set.type: keyword Note: This field should contain an array of values. example: [sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]  container.image.repo_digests |
extended |
| container.image.name | Name of the image the container was built on. type: keyword container.image.name |
extended |
| container.image.tag | Container image tags. type: keyword Note: This field should contain an array of values. container.image.tags |
extended |
| container.labels | Image labels. type: object  container.label |
extended |
| container.memory.usage | Memory usage percentage and it ranges from 0 to 1. Scaling factor: 1000. type: scaled_float container.memory.usage |
extended |
| container.name | Container name. type: keyword container.name |
extended |
| container.network.egress.bytes | The number of bytes (gauge) sent out on all network interfaces by the container since the last metric collection. type: long |
extended |
| container.network.ingress.bytes | The number of bytes received (gauge) on all network interfaces by the container since the last metric collection. type: long |
extended |
| container.runtime | Runtime managing this container. type: keyword example: docker container.runtime.name |
extended |
| container.security_context.privileged | Indicates whether the container is running in privileged mode. type: boolean |
extended |