Enhance FIM and Inventory indices settings (#939)

abbonno · AlexRuiz7 · web-flow · commit f0b2ab868955 · 2025-06-10T18:37:10.000+02:00
Co-authored-by: Álex Ruiz Becerra &lt;alejandro.ruiz.becerra@wazuh.com&gt;
diff --git a/ecs/states-fim-files/docs/fields.csv b/ecs/states-fim-files/docs/fields.csv
@@ -13,7 +13,6 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.11.0,true,file,file.mtime,date,extended,,,Last time the file content was modified.
 8.11.0,true,file,file.owner,keyword,extended,,alice,File owner's username.
 8.11.0,true,file,file.path,keyword,extended,,/home/alice/example.png,"Full path to the file, including the file name."
-8.11.0,true,file,file.path.text,keyword,extended,,/home/alice/example.png,"Full path to the file, including the file name."
 8.11.0,true,file,file.size,long,extended,,16384,File size in bytes.
 8.11.0,true,file,file.uid,keyword,extended,,1001,The user ID (UID) or security identifier (SID) of the file owner.
 8.11.0,true,wazuh,wazuh.cluster.name,keyword,custom,,,Wazuh cluster name.
diff --git a/ecs/states-fim-files/fields/template-settings-legacy.json b/ecs/states-fim-files/fields/template-settings-legacy.json
@@ -5,6 +5,7 @@
     "index": {
       "number_of_shards": "1",
       "number_of_replicas": "0",
+      "auto_expand_replicas": "0-1",
       "refresh_interval": "5s",
       "query.default_field": [
         "agent.host.architecture",
diff --git a/ecs/states-fim-files/fields/template-settings.json b/ecs/states-fim-files/fields/template-settings.json
@@ -6,6 +6,7 @@
       "index": {
         "number_of_shards": "1",
         "number_of_replicas": "0",
+        "auto_expand_replicas": "0-1",
         "refresh_interval": "5s",
         "query.default_field": [
           "agent.host.architecture",
diff --git a/ecs/states-fim-registries/fields/template-settings-legacy.json b/ecs/states-fim-registries/fields/template-settings-legacy.json
@@ -5,6 +5,7 @@
     "index": {
       "number_of_shards": "1",
       "number_of_replicas": "0",
+      "auto_expand_replicas": "0-1",
       "refresh_interval": "5s",
       "query.default_field": [
         "agent.host.architecture",
diff --git a/ecs/states-fim-registries/fields/template-settings.json b/ecs/states-fim-registries/fields/template-settings.json
@@ -6,6 +6,7 @@
       "index": {
         "number_of_shards": "1",
         "number_of_replicas": "0",
+        "auto_expand_replicas": "0-1",
         "refresh_interval": "5s",
         "query.default_field": [
           "agent.host.architecture",
diff --git a/ecs/states-inventory-hardware/fields/template-settings-legacy.json b/ecs/states-inventory-hardware/fields/template-settings-legacy.json
@@ -5,9 +5,19 @@
     "index": {
       "number_of_shards": "1",
       "number_of_replicas": "0",
+      "auto_expand_replicas": "0-1",
       "refresh_interval": "5s",
       "query.default_field": [
-        "host.serial_number"
+        "agent.host.architecture",
+        "agent.host.ip",
+        "agent.id",
+        "agent.name",
+        "agent.version",
+        "agent.host.ip",
+        "host.serial_number",
+        "wazuh.cluster.name",
+        "wazuh.cluster.node",
+        "wazuh.schema.version"
       ]
     }
   }
diff --git a/ecs/states-inventory-hardware/fields/template-settings.json b/ecs/states-inventory-hardware/fields/template-settings.json
@@ -8,11 +8,21 @@
       "index": {
         "number_of_shards": "1",
         "number_of_replicas": "0",
+        "auto_expand_replicas": "0-1",
         "refresh_interval": "5s",
         "query.default_field": [
-          "host.serial_number"
+          "agent.host.architecture",
+          "agent.host.ip",
+          "agent.id",
+          "agent.name",
+          "agent.version",
+          "agent.host.ip",
+          "host.serial_number",
+          "wazuh.cluster.name",
+          "wazuh.cluster.node",
+          "wazuh.schema.version"
         ]
       }
     }
   }
-}
+}
diff --git a/ecs/states-inventory-hotfixes/fields/template-settings-legacy.json b/ecs/states-inventory-hotfixes/fields/template-settings-legacy.json
@@ -5,9 +5,18 @@
     "index": {
       "number_of_shards": "1",
       "number_of_replicas": "0",
+      "auto_expand_replicas": "0-1",
       "refresh_interval": "5s",
       "query.default_field": [
-        "package.hotfix.name"
+        "agent.host.architecture",
+        "agent.host.ip",
+        "agent.id",
+        "agent.name",
+        "agent.version",
+        "package.hotfix.name",
+        "wazuh.cluster.name",
+        "wazuh.cluster.node",
+        "wazuh.schema.version"
       ]
     }
   }
diff --git a/ecs/states-inventory-hotfixes/fields/template-settings.json b/ecs/states-inventory-hotfixes/fields/template-settings.json
@@ -8,11 +8,20 @@
       "index": {
         "number_of_shards": "1",
         "number_of_replicas": "0",
+        "auto_expand_replicas": "0-1",
         "refresh_interval": "5s",
         "query.default_field": [
-          "package.hotfix.name"
+        "agent.host.architecture",
+        "agent.host.ip",
+        "agent.id",
+        "agent.name",
+        "agent.version",
+        "package.hotfix.name",
+        "wazuh.cluster.name",
+        "wazuh.cluster.node",
+        "wazuh.schema.version"
         ]
       }
     }
   }
-}
+}
diff --git a/ecs/states-inventory-interfaces/docs/fields.csv b/ecs/states-inventory-interfaces/docs/fields.csv
@@ -13,6 +13,11 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.11.0,true,host,host.network.ingress.drops,long,custom,,,Number of dropped received packets.
 8.11.0,true,host,host.network.ingress.errors,long,custom,,,Number of reception errors.
 8.11.0,true,host,host.network.ingress.packets,long,extended,,,The number of packets received on all network interfaces.
+8.11.0,true,interface,interface.alias,keyword,extended,,outside,Interface alias
+8.11.0,true,interface,interface.mtu,long,custom,,,Maximum transmission unit size.
+8.11.0,true,interface,interface.name,keyword,extended,,eth0,Interface name
+8.11.0,true,interface,interface.state,keyword,custom,,,State of the network interface.
+8.11.0,true,interface,interface.type,keyword,custom,,,Interface type.
 8.11.0,true,wazuh,wazuh.cluster.name,keyword,custom,,,Wazuh cluster name.
 8.11.0,true,wazuh,wazuh.cluster.node,keyword,custom,,,Wazuh cluster node name.
 8.11.0,true,wazuh,wazuh.schema.version,keyword,custom,,,Wazuh schema version.
diff --git a/ecs/states-inventory-interfaces/fields/custom/interface.yml b/ecs/states-inventory-interfaces/fields/custom/interface.yml
@@ -1,5 +1,10 @@
 ---
 - name: interface
+  reusable:
+    top_level: true
+    expected:
+      - observer.ingress
+      - observer.egress
   title: Interface
   type: group
   group: 2
diff --git a/ecs/states-inventory-interfaces/fields/template-settings-legacy.json b/ecs/states-inventory-interfaces/fields/template-settings-legacy.json
@@ -5,6 +5,7 @@
     "index": {
       "number_of_shards": "1",
       "number_of_replicas": "0",
+      "auto_expand_replicas": "0-1",
       "refresh_interval": "5s",
       "query.default_field": [
         "agent.id",
diff --git a/ecs/states-inventory-interfaces/fields/template-settings.json b/ecs/states-inventory-interfaces/fields/template-settings.json
@@ -8,12 +8,18 @@
       "index": {
         "number_of_shards": "1",
         "number_of_replicas": "0",
+        "auto_expand_replicas": "0-1",
         "refresh_interval": "5s",
         "query.default_field": [
           "agent.id",
-          "agent.ip",
+          "agent.name",
+          "agent.version",
+          "agent.host.ip",
+          "host.mac",
           "interface.name",
-          "interface.alias"
+          "interface.alias",
+          "wazuh.cluster.name",
+          "wazuh.cluster.node"
         ]
       }
     }
diff --git a/ecs/states-inventory-networks/docs/fields.csv b/ecs/states-inventory-networks/docs/fields.csv
@@ -4,6 +4,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.11.0,true,agent,agent.id,keyword,core,,8a4f500d,Unique identifier of this agent.
 8.11.0,true,agent,agent.name,keyword,core,,foo,Custom name of the agent.
 8.11.0,true,agent,agent.version,keyword,core,,6.0.0-rc2,Version of the agent.
+8.11.0,true,interface,interface.name,keyword,extended,,eth0,Interface name
 8.11.0,true,network,network.broadcast,ip,custom,,,Broadcast address
 8.11.0,true,network,network.dhcp,boolean,custom,,,DHCP enabled
 8.11.0,true,network,network.ip,ip,custom,,,IP address
diff --git a/ecs/states-inventory-networks/fields/custom/interface.yml b/ecs/states-inventory-networks/fields/custom/interface.yml
@@ -0,0 +1,7 @@
+---
+- name: interface
+  reusable:
+    top_level: true
+    expected:
+      - observer.ingress
+      - observer.egress
diff --git a/ecs/states-inventory-networks/fields/template-settings-legacy.json b/ecs/states-inventory-networks/fields/template-settings-legacy.json
@@ -5,10 +5,18 @@
     "index": {
       "number_of_shards": "1",
       "number_of_replicas": "0",
+      "auto_expand_replicas": "0-1",
       "refresh_interval": "5s",
       "query.default_field": [
+        "agent.id",
+        "agent.name",
+        "agent.version",
+        "agent.host.ip",
+        "interface.name",
         "network.ip",
-        "network.name"
+        "network.name",
+        "wazuh.cluster.name",
+        "wazuh.cluster.node"
       ]
     }
   }
diff --git a/ecs/states-inventory-networks/fields/template-settings.json b/ecs/states-inventory-networks/fields/template-settings.json
@@ -8,10 +8,18 @@
       "index": {
         "number_of_shards": "1",
         "number_of_replicas": "0",
+        "auto_expand_replicas": "0-1",
         "refresh_interval": "5s",
         "query.default_field": [
+          "agent.id",
+          "agent.name",
+          "agent.version",
+          "agent.host.ip",
+          "interface.name",
           "network.ip",
-          "network.name"
+          "network.name",
+          "wazuh.cluster.name",
+          "wazuh.cluster.node"
         ]
       }
     }
diff --git a/ecs/states-inventory-packages/fields/template-settings-legacy.json b/ecs/states-inventory-packages/fields/template-settings-legacy.json
@@ -5,6 +5,7 @@
     "index": {
       "number_of_shards": "1",
       "number_of_replicas": "0",
+      "auto_expand_replicas": "0-1",
       "refresh_interval": "5s",
       "query.default_field": [
         "agent.host.architecture",
diff --git a/ecs/states-inventory-packages/fields/template-settings.json b/ecs/states-inventory-packages/fields/template-settings.json
@@ -6,6 +6,7 @@
       "index": {
         "number_of_shards": "1",
         "number_of_replicas": "0",
+        "auto_expand_replicas": "0-1",
         "refresh_interval": "5s",
         "query.default_field": [
           "agent.host.architecture",
diff --git a/ecs/states-inventory-ports/docs/fields.csv b/ecs/states-inventory-ports/docs/fields.csv
@@ -12,7 +12,6 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.11.0,true,interface,interface.state,keyword,custom,,,State of the network interface.
 8.11.0,true,network,network.transport,keyword,core,,tcp,Protocol Name corresponding to the field `iana_number`.
 8.11.0,true,process,process.name,keyword,extended,,ssh,Process name.
-8.11.0,true,process,process.name.text,keyword,extended,,ssh,Process name.
 8.11.0,true,process,process.pid,long,core,,4242,Process id.
 8.11.0,true,source,source.ip,ip,core,,,IP address of the source.
 8.11.0,true,source,source.port,long,core,,,Port of the source.
diff --git a/ecs/states-inventory-ports/fields/template-settings-legacy.json b/ecs/states-inventory-ports/fields/template-settings-legacy.json
@@ -5,12 +5,26 @@
     "index": {
       "number_of_shards": "1",
       "number_of_replicas": "0",
+      "auto_expand_replicas": "0-1",
       "refresh_interval": "5s",
       "query.default_field": [
+        "agent.host.architecture",
+        "agent.host.ip",
         "agent.id",
+        "agent.name",
+        "agent.version",
+        "host.network.egress.queue",
+        "host.network.ingress.queue",
+        "file.inode",
+        "interface.state",
+        "network.transport",
         "process.name",
+        "process.pid",
         "source.ip",
-        "destination.ip"
+        "destination.ip",
+        "wazuh.cluster.name",
+        "wazuh.cluster.node",
+        "wazuh.schema.version"
       ]
     }
   }
diff --git a/ecs/states-inventory-ports/fields/template-settings.json b/ecs/states-inventory-ports/fields/template-settings.json
@@ -8,12 +8,26 @@
       "index": {
         "number_of_shards": "1",
         "number_of_replicas": "0",
+        "auto_expand_replicas": "0-1",
         "refresh_interval": "5s",
         "query.default_field": [
+          "agent.host.architecture",
+          "agent.host.ip",
           "agent.id",
+          "agent.name",
+          "agent.version",
+          "host.network.egress.queue",
+          "host.network.ingress.queue",
+          "file.inode",
+          "interface.state",
+          "network.transport",
           "process.name",
+          "process.pid",
           "source.ip",
-          "destination.ip"
+          "destination.ip",
+          "wazuh.cluster.name",
+          "wazuh.cluster.node",
+          "wazuh.schema.version"
         ]
       }
     }
diff --git a/ecs/states-inventory-processes/docs/fields.csv b/ecs/states-inventory-processes/docs/fields.csv
@@ -7,9 +7,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.11.0,true,process,process.args,keyword,extended,array,"[""/usr/bin/ssh"", ""-l"", ""user"", ""10.0.0.16""]",Array of process arguments.
 8.11.0,true,process,process.args_count,long,extended,,4,Length of the process.args array.
 8.11.0,true,process,process.command_line,keyword,extended,,/usr/bin/ssh -l user 10.0.0.16,Full command line that started the process.
-8.11.0,true,process,process.command_line.text,keyword,extended,,/usr/bin/ssh -l user 10.0.0.16,Full command line that started the process.
 8.11.0,true,process,process.name,keyword,extended,,ssh,Process name.
-8.11.0,true,process,process.name.text,keyword,extended,,ssh,Process name.
 8.11.0,true,process,process.parent.pid,long,core,,4242,Process id.
 8.11.0,true,process,process.pid,long,core,,4242,Process id.
 8.11.0,true,process,process.start,date,extended,,2016-05-23T08:05:34.853Z,The time the process started.
diff --git a/ecs/states-inventory-processes/fields/template-settings-legacy.json b/ecs/states-inventory-processes/fields/template-settings-legacy.json
@@ -5,6 +5,7 @@
     "index": {
       "number_of_shards": "1",
       "number_of_replicas": "0",
+      "auto_expand_replicas": "0-1",
       "refresh_interval": "5s",
       "query.default_field": [
         "agent.host.architecture",
diff --git a/ecs/states-inventory-processes/fields/template-settings.json b/ecs/states-inventory-processes/fields/template-settings.json
@@ -6,6 +6,7 @@
       "index": {
         "number_of_shards": "1",
         "number_of_replicas": "0",
+        "auto_expand_replicas": "0-1",
         "refresh_interval": "5s",
         "query.default_field": [
           "agent.host.architecture",
diff --git a/ecs/states-inventory-protocols/docs/fields.csv b/ecs/states-inventory-protocols/docs/fields.csv
@@ -4,6 +4,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.11.0,true,agent,agent.id,keyword,core,,8a4f500d,Unique identifier of this agent.
 8.11.0,true,agent,agent.name,keyword,core,,foo,Custom name of the agent.
 8.11.0,true,agent,agent.version,keyword,core,,6.0.0-rc2,Version of the agent.
+8.11.0,true,interface,interface.name,keyword,extended,,eth0,Interface name
 8.11.0,true,network,network.dhcp,boolean,custom,,,DHCP enabled
 8.11.0,true,network,network.gateway,ip,custom,,,Gateway address
 8.11.0,true,network,network.metric,long,custom,,,Metric of the network protocol
diff --git a/ecs/states-inventory-protocols/fields/custom/interface.yml b/ecs/states-inventory-protocols/fields/custom/interface.yml
@@ -0,0 +1,7 @@
+---
+- name: interface
+  reusable:
+    top_level: true
+    expected:
+      - observer.ingress
+      - observer.egress
diff --git a/ecs/states-inventory-protocols/fields/template-settings-legacy.json b/ecs/states-inventory-protocols/fields/template-settings-legacy.json
@@ -5,11 +5,19 @@
     "index": {
       "number_of_shards": "1",
       "number_of_replicas": "0",
+      "auto_expand_replicas": "0-1",
       "refresh_interval": "5s",
       "query.default_field": [
-          "agent.id",
-          "agent.host.ip",
-          "interface.name"
+        "agent.host.architecture",
+        "agent.host.ip",
+        "agent.id",
+        "agent.name",
+        "agent.version",
+        "network.type",
+        "interface.name",
+        "wazuh.cluster.name",
+        "wazuh.cluster.node",
+        "wazuh.schema.version"
       ]
     }
   }
diff --git a/ecs/states-inventory-protocols/fields/template-settings.json b/ecs/states-inventory-protocols/fields/template-settings.json
diff --git a/ecs/states-inventory-system/docs/fields.csv b/ecs/states-inventory-system/docs/fields.csv
diff --git a/ecs/states-inventory-system/fields/template-settings-legacy.json b/ecs/states-inventory-system/fields/template-settings-legacy.json
diff --git a/ecs/states-inventory-system/fields/template-settings.json b/ecs/states-inventory-system/fields/template-settings.json
diff --git a/ecs/states-vulnerabilities/fields/template-settings-legacy.json b/ecs/states-vulnerabilities/fields/template-settings-legacy.json
diff --git a/ecs/states-vulnerabilities/fields/template-settings.json b/ecs/states-vulnerabilities/fields/template-settings.json

Original file line number	Diff line number	Diff line change
`@@ -8,11 +8,21 @@`
`8`	`8`	`"index": {`
`9`	`9`	`"number_of_shards": "1",`
`10`	`10`	`"number_of_replicas": "0",`
	`11`	`+ "auto_expand_replicas": "0-1",`
`11`	`12`	`"refresh_interval": "5s",`
`12`	`13`	`"query.default_field": [`
`13`		`- "host.serial_number"`
	`14`	`+ "agent.host.architecture",`
	`15`	`+ "agent.host.ip",`
	`16`	`+ "agent.id",`
	`17`	`+ "agent.name",`
	`18`	`+ "agent.version",`
	`19`	`+ "agent.host.ip",`
	`20`	`+ "host.serial_number",`
	`21`	`+ "wazuh.cluster.name",`
	`22`	`+ "wazuh.cluster.node",`
	`23`	`+ "wazuh.schema.version"`
`14`	`24`	`]`
`15`	`25`	`}`
`16`	`26`	`}`
`17`	`27`	`}`
`18`		`-}`
	`28`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -8,11 +8,20 @@`
`8`	`8`	`"index": {`
`9`	`9`	`"number_of_shards": "1",`
`10`	`10`	`"number_of_replicas": "0",`
	`11`	`+ "auto_expand_replicas": "0-1",`
`11`	`12`	`"refresh_interval": "5s",`
`12`	`13`	`"query.default_field": [`
`13`		`- "package.hotfix.name"`
	`14`	`+ "agent.host.architecture",`
	`15`	`+ "agent.host.ip",`
	`16`	`+ "agent.id",`
	`17`	`+ "agent.name",`
	`18`	`+ "agent.version",`
	`19`	`+ "package.hotfix.name",`
	`20`	`+ "wazuh.cluster.name",`
	`21`	`+ "wazuh.cluster.node",`
	`22`	`+ "wazuh.schema.version"`
`14`	`23`	`]`
`15`	`24`	`}`
`16`	`25`	`}`
`17`	`26`	`}`
`18`		`-}`
	`27`	`+}`