input

type Answer struct {
	Type string
	Data string
}

type ECSMetadata struct {
	Metadata Metadata `json:"@metadata"`
}

type ECSRecord struct {
	RFCTimestamp string `json:"@timestamp"`

	Agent struct {
		Hostname string
		ID       string
	}
	Host struct {
		IP []string
	}
	Source struct {
		IP   string
		Port json.Number
	}
	Destination struct {
		IP   string
		Port json.Number
	}
	Network struct {
		Transport string // RITA Proto
		Protocol  string // RITA Service
	}
	Event struct {
		//		Duration float64 // Not supported by sysmon/ winlogbeat. Use with packetbeat.
		Provider string
		Code     json.Number
	}
	DNS struct {
		Answers  []Answer
		Question struct {
			Name string
		}
	}
}

type ECSRecordv8 struct {
	RFCTimestamp string `json:"@timestamp"`

	Agent struct {
		Name string
		ID   string
	}

	Host struct {
		IP []string
	}

	Winlog struct {
		EventData EventDatav8 `json:"event_data"`
	}

	Event struct {
		Provider string
		Code     string
	}
}

type EventDatav8 struct {
	SourceIp            string
	SourcePort          string
	DestinationIp       string
	DestinationPort     string
	Protocol            string // ECS Transport, RITA Proto
	DestinationPortName string // ECS Protocol, RITA Service
	QueryName           string
	QueryResults        string
	UtcTime             string
}

type Metadata struct {
	Version string `json:"version"`
}