/** * A reusable set of identifier fields used to reference other entities in relationship contexts. Each field holds a keyword array of identifiers following the same conventions as the corresponding ECS root field. Only the fields defined in this field set might appear, ad-hoc or integration-specific property names are not allowed. */ export interface EcsEntityReference { entity?: { /** * Identifiers of referenced entities, using the same meaning as root `entity.id` (stable id for correlation within scope). */ id?: string | Array; }; host?: { /** * Referenced host ids. */ id?: string | Array; /** * Referenced host names. */ name?: string | Array; }; service?: { /** * Referenced service ids. */ id?: string | Array; /** * Referenced service names. */ name?: string | Array; }; user?: { /** * Referenced user directory or AD/LDAP domain names (same semantics as ECS `user.domain`). */ domain?: string | Array; /** * Referenced user email addresses. */ email?: string | Array; /** * Referenced user ids. */ id?: string | Array; /** * Referenced user short names or logins. */ name?: string | Array; }; }