# Suggestion for field name **URL:** \ **Category:** Beats\ **Tags:** ecs-elastic-common-schema, filebeat\ **Created:** [July 21, 2020, 10:04pm UTC](https://discuss.elastic.co/t/suggestion-for-field-name/242105 "2020-07-21T22:04:59Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![opoplawski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/opoplawski/32/40442_2.png) [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Post date:** [July 21, 2020, 10:04pm UTC](https://discuss.elastic.co/t/suggestion-for-field-name/242105/1 "2020-07-21T22:04:59Z")
I'm parsing logs from e2guardian - a web filter. One of the fields is basically "why" a request was block. For e.g.: ```auto 2020.04.06 12:21:37 - 10.11.2.22 https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-23460252-1&cid=840626379.1586197112&jid=529282670&_gid=2125124794.1586197112&gjid=493219403&_v=j81&z=169728763 *DENIED* Blocked site: doubleclick.net GET 0 0 - 1403 - 10.11.2.22 no_name_group ``` I'm looking for suggestions for a field name to use for this. Currently I'm just calling this "why" ```auto match => { "message" => "(?\d\d\d\d\.\d\d\.\d\d \d\d:\d\d:\d\d)\t%{NOTSPACE:user.name}\t%{IP:client.address}\t%{NOTSPACE:url.full}\t%{NOTSPACE:action} ?(hw\d+: )?(?[^\t]+)?\t%{WORD:http.request.method}\t%{NUMBER:http.request.bytes}\t\d+\t[^\t]+\t[^\t]+\t%{NUMBER:http.response.status_code}\t[^\t]+\t%{IP:client.ip}" } ``` but that currently isn't defined. ---
**Author:** ![ebeahan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ebeahan/32/78989_2.png) [@ebeahan](https://discuss.elastic.co/u/ebeahan)\ **Post date:** [July 21, 2020, 11:51pm UTC](https://discuss.elastic.co/t/suggestion-for-field-name/242105/2 "2020-07-21T23:51:40Z")
Hi @opoplawski! The action being observed in an event should be captured in `event.action`. There's also an opportunity to leverage the [categorization fields](https://www.elastic.co/guide/en/ecs/current/ecs-category-field-values-reference.html) to better capture the "what it is" of the event. For example, using the current example web filter event: `event.kind`: "event" `event.category`: ["network"] `event.type`: ["connection", "denied"] `event.outcome`: "success" The docs covering the different event field set can be found [here](https://www.elastic.co/guide/en/ecs/current/ecs-event.html). ---
**Author:** ![webmat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/webmat/32/46191_2.png) [@webmat](https://discuss.elastic.co/u/webmat)\ **Post date:** [July 22, 2020, 1:01pm UTC](https://discuss.elastic.co/t/suggestion-for-field-name/242105/3 "2020-07-22T13:01:38Z")
Looking at the grok, it seems like there's both an action and a reason defined by the source, however. Perhaps adding `event.reason` would be useful, actually 🙂 Note: I see the "action" field is not using the ECS field, I would recommend moving it to `%{NOTSPACE:event.action}` ---
**Author:** ![opoplawski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/opoplawski/32/40442_2.png) [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Post date:** [July 22, 2020, 7:12pm UTC](https://discuss.elastic.co/t/suggestion-for-field-name/242105/4 "2020-07-22T19:12:59Z")
Thanks. Two questions: - Is event type "access" relevant here as well? - Is event.outcome "success" correct for a connection being denied? ---
**Author:** ![opoplawski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/opoplawski/32/40442_2.png) [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Post date:** [July 22, 2020, 7:13pm UTC](https://discuss.elastic.co/t/suggestion-for-field-name/242105/5 "2020-07-22T19:13:59Z")
RIght, it's the reason that I'm having a hard time figuring out where to place. ---
**Author:** ![ebeahan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ebeahan/32/78989_2.png) [@ebeahan](https://discuss.elastic.co/u/ebeahan)\ **Post date:** [July 24, 2020, 3:50am UTC](https://discuss.elastic.co/t/suggestion-for-field-name/242105/6 "2020-07-24T03:50:22Z")
> Is event type "access" relevant here as well? I would say no since the connection is being denied and the resource ultimately wasn't accessed. > Is event.outcome "success" correct for a connection being denied? From the perspective of the entity that emitted the event, the web filter, the blocked connection was a successful and expected operation, so `success` is appropriate. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 21, 2020, 5:50am UTC](https://discuss.elastic.co/t/suggestion-for-field-name/242105/7 "2020-08-21T05:50:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.