volume.yml

# Licensed to Elasticsearch B.V. under one or more contributor
# license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright
# ownership. Elasticsearch B.V. licenses this file to you under
# the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# 	http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
---
- name: volume
  title: Volume
  group: 2
  description: >
    Fields related to storage volume details.
  beta: >
    These fields are beta and are subject to change.
  type: group
  fields:
    - name: mount_name
      level: extended
      type: keyword
      short: Mount name of the volume.
      description: >
        Mount name of the volume device.

        Only populate this field for POSIX system volumes.

    - name: device_name
      level: extended
      type: keyword
      short: Device name of the volume.
      description: >
        Full path of the volume device.

        Only populate this field for POSIX system volumes.

    - name: dos_name
      level: extended
      type: keyword
      short: DOS name of the device.
      description: >
        The MS-DOS name of a device.

        DOS device name is in the format of driver letters, such as `C:`. The
        field is relevant to Windows systems only.
      example: "E:"

    - name: nt_name
      level: extended
      type: keyword
      short: NT name of the device.
      description: >
        The NT device name.

        NT device name uses a format of `\Device\HarddiskVolume2`. The
        field is relevant to Windows systems only.
      example: \Device\Cdrom1

    - name: bus_type
      level: extended
      type: keyword
      short: Bus type of the device.
      description: >
        Bus type of the device, such as `Nvme`, `Usb`, or `FileBackedVirtual`.
      example: "FileBackedVirtual"

    - name: writable
      level: extended
      type: boolean
      description: >
        Indicates if the volume is writable.

    - name: default_access
      level: extended
      type: keyword
      short: Bus type of the device.
      description: >
        Describes the default access(es) of the volume.

    - name: file_system_type
      level: extended
      type: keyword
      short: Volume device file system type.
      description: >
        Volume device file system type.

        The most common volume file system types are `NTFS` and `UDF`.

    - name: product_id
      level: extended
      type: keyword
      short: ProductID of the device.
      description: >
        ProductID of the device.

        The vendor provides the ProductID for the volume, if any.

    - name: product_name
      level: extended
      type: keyword
      short: Produce name of the volume.
      description: >
        Product name of the volume.

        The volume device vendor provides this value.
      example: "Virtual DVD-ROM"

    - name: vendor_id
      level: extended
      type: keyword
      short: VendorID of the device.
      description: >
        VendorID of the volume device.

        The volume device vendor provides this value.

    - name: vendor_name
      level: extended
      type: keyword
      short: Vendor name of the device.
      description: >
        Vendor name of the volume device.

        The value is provided by the vendor of the device.
      example: "Msft"

    - name: serial_number
      level: extended
      type: keyword
      short: Serial number of the device.
      description: >
        Serial number identifier for the volume device.

        The serial number is provided by the vendor of the device, if any.

    - name: device_type
      level: extended
      type: keyword
      short: Volume device type.
      description: >
        Volume device type.

        The most frequently seen volume device types are `Disk File System` and
        `CD-ROM File System`.
      example: "CD-ROM File System"

    - name: size
      level: extended
      type: long
      description: >
        Size of the volume device in bytes.

    - name: removable
      level: extended
      type: boolean
      description: >
        Indicates if the volume is removable.