In ECS we don't have a clear concept of sessions, so you couldn't capture many details about a session. For session duration, however, you can use
event.duration. This field is meant to capture the duration of any kind of event, so if you have a log event that reports the duration of a finished session, this sounds like a good fit.
For the network transfer metrics, there's a mix of fields that could be interesting in network and in source and destination. Here's a few ideas:
- rx bytes and packets in source.bytes and source.packets
- tx bytes and packets in destination.bytes and destination.packets
- for network address translation you can capture up to 4 addresses with source.ip, source.nat.ip, destination.ip and destination.nat.ip
- total tx bytes and packets in network.bytes and network.packets
- You may also be interested in looking into network.protocol, network.direction, network.application and a few others under