Remove deprecated host.user.* fields

CHANGELOG.next.md

@@ -12,6 +12,7 @@ Thanks, you're awesome :-) -->
 
 * Removing deprecated --oss from generator #1404
 * Removing use-cases directory #1405
+* Remove `host.user.*` field reuse. #1439
 
 ### Schema Changes
 

docs/field-details.asciidoc

@@ -4141,13 +4141,6 @@ example: `1325`
 // ===============================================================
 
 
-| <<ecs-user,user>>
-| `host.user.*`
-| This reuse is deprecated and will be removed in the next major ECS version.
-
-// ===============================================================
-
-
 |=====
 
 [[ecs-http]]
@@ -8765,7 +8758,7 @@ example: `["kibana_admin", "reporting_user"]`
 [discrete]
 ==== Field Reuse
 
-The `user` fields are expected to be nested at: `client.user`, `destination.user`, `host.user`, `server.user`, `source.user`, `user.changes`, `user.effective`, `user.target`.
+The `user` fields are expected to be nested at: `client.user`, `destination.user`, `server.user`, `source.user`, `user.changes`, `user.effective`, `user.target`.
 
 Note also that the `user` fields may be used directly at the root of the events.
 

docs/usage/user.asciidoc

@@ -18,8 +18,6 @@ Here are the subjects covered in this page.
 
 * <<ecs-user-usage-mappings>>
 
-* <<ecs-user-usage-deprecations>>
-
 [discrete]
 [[ecs-user-usage-categorization]]
 ===== Categorization
@@ -113,7 +111,6 @@ Here's the full list of places where the user fields can appear:
 * `destination.user.*`
 * `client.user.*`
 * `server.user.*`
-* `host.user.*` (<<ecs-user-usage-deprecations,deprecated>>)
 
 Let's go over the meaning of each.
 
@@ -421,10 +418,3 @@ it's the creation / rename of the user, or events where this user was active in
 
 For examples of mapping events from various sources, you can look at
 https:/elastic/ecs/blob/master/rfcs/text/0007-multiple-users.md#source-data[RFC 0007 in section Source Data].
-
-[discrete]
-[[ecs-user-usage-deprecations]]
-===== Deprecations
-
-As of ECS 1.8, `host.user.*` fields are deprecated and will be removed at the next
-major version of ECS.

experimental/generated/beats/fields.ecs.yml

@@ -3309,75 +3309,6 @@
  type: long
  description: Seconds the host has been up.
  example: 1325
- - name: user.domain
- level: extended
- type: keyword
- ignore_above: 1024
- description: 'Name of the directory the user is a member of.
-
- For example, an LDAP or Active Directory domain name.'
- - name: user.email
- level: extended
- type: wildcard
- description: User email address.
- - name: user.full_name
- level: extended
- type: wildcard
- multi_fields:
- - name: text
- type: text
- norms: false
- default_field: false
- description: User's full name, if available.
- example: Albert Einstein
- - name: user.group.domain
- level: extended
- type: keyword
- ignore_above: 1024
- description: 'Name of the directory the group is a member of.
-
- For example, an LDAP or Active Directory domain name.'
- - name: user.group.id
- level: extended
- type: keyword
- ignore_above: 1024
- description: Unique identifier for the group on the system/platform.
- - name: user.group.name
- level: extended
- type: keyword
- ignore_above: 1024
- description: Name of the group.
- - name: user.hash
- level: extended
- type: keyword
- ignore_above: 1024
- description: 'Unique user hash to correlate information for a user in anonymized
- form.
-
- Useful if `user.id` or `user.name` contain confidential information and cannot
- be used.'
- - name: user.id
- level: core
- type: keyword
- ignore_above: 1024
- description: Unique identifier of the user.
- - name: user.name
- level: core
- type: wildcard
- multi_fields:
- - name: text
- type: text
- norms: false
- default_field: false
- description: Short name or login of the user.
- example: albert
- - name: user.roles
- level: extended
- type: keyword
- ignore_above: 1024
- description: Array of user roles at the time of the event.
- example: '["kibana_admin", "reporting_user"]'
- default_field: false
  - name: http
  title: HTTP
  group: 2

experimental/generated/csv/fields.csv

@@ -372,18 +372,6 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 2.0.0-dev+exp,true,host,host.os.version,keyword,extended,,10.14.1,Operating system version as a raw string.
 2.0.0-dev+exp,true,host,host.type,keyword,core,,,Type of host.
 2.0.0-dev+exp,true,host,host.uptime,long,extended,,1325,Seconds the host has been up.
-2.0.0-dev+exp,true,host,host.user.domain,keyword,extended,,,Name of the directory the user is a member of.
-2.0.0-dev+exp,true,host,host.user.email,wildcard,extended,,,User email address.
-2.0.0-dev+exp,true,host,host.user.full_name,wildcard,extended,,Albert Einstein,"User's full name, if available."
-2.0.0-dev+exp,true,host,host.user.full_name.text,text,extended,,Albert Einstein,"User's full name, if available."
-2.0.0-dev+exp,true,host,host.user.group.domain,keyword,extended,,,Name of the directory the group is a member of.
-2.0.0-dev+exp,true,host,host.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
-2.0.0-dev+exp,true,host,host.user.group.name,keyword,extended,,,Name of the group.
-2.0.0-dev+exp,true,host,host.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form.
-2.0.0-dev+exp,true,host,host.user.id,keyword,core,,,Unique identifier of the user.
-2.0.0-dev+exp,true,host,host.user.name,wildcard,core,,albert,Short name or login of the user.
-2.0.0-dev+exp,true,host,host.user.name.text,text,core,,albert,Short name or login of the user.
-2.0.0-dev+exp,true,host,host.user.roles,keyword,extended,array,"[""kibana_admin"", ""reporting_user""]",Array of user roles at the time of the event.
 2.0.0-dev+exp,true,http,http.request.body.bytes,long,extended,,887,Size in bytes of the request body.
 2.0.0-dev+exp,true,http,http.request.body.content,wildcard,extended,,Hello world,The full HTTP request body.
 2.0.0-dev+exp,true,http,http.request.body.content.text,text,extended,,Hello world,The full HTTP request body.

experimental/generated/ecs/ecs_flat.yml

@@ -4900,135 +4900,6 @@ host.uptime:
  normalize: []
  short: Seconds the host has been up.
  type: long
-host.user.domain:
- dashed_name: host-user-domain
- description: 'Name of the directory the user is a member of.
-
- For example, an LDAP or Active Directory domain name.'
- flat_name: host.user.domain
- ignore_above: 1024
- level: extended
- name: domain
- normalize: []
- original_fieldset: user
- short: Name of the directory the user is a member of.
- type: keyword
-host.user.email:
- dashed_name: host-user-email
- description: User email address.
- flat_name: host.user.email
- level: extended
- name: email
- normalize: []
- original_fieldset: user
- short: User email address.
- type: wildcard
-host.user.full_name:
- dashed_name: host-user-full-name
- description: User's full name, if available.
- example: Albert Einstein
- flat_name: host.user.full_name
- level: extended
- multi_fields:
- - flat_name: host.user.full_name.text
- name: text
- norms: false
- type: text
- name: full_name
- normalize: []
- original_fieldset: user
- short: User's full name, if available.
- type: wildcard
-host.user.group.domain:
- dashed_name: host-user-group-domain
- description: 'Name of the directory the group is a member of.
-
- For example, an LDAP or Active Directory domain name.'
- flat_name: host.user.group.domain
- ignore_above: 1024
- level: extended
- name: domain
- normalize: []
- original_fieldset: group
- short: Name of the directory the group is a member of.
- type: keyword
-host.user.group.id:
- dashed_name: host-user-group-id
- description: Unique identifier for the group on the system/platform.
- flat_name: host.user.group.id
- ignore_above: 1024
- level: extended
- name: id
- normalize: []
- original_fieldset: group
- short: Unique identifier for the group on the system/platform.
- type: keyword
-host.user.group.name:
- dashed_name: host-user-group-name
- description: Name of the group.
- flat_name: host.user.group.name
- ignore_above: 1024
- level: extended
- name: name
- normalize: []
- original_fieldset: group
- short: Name of the group.
- type: keyword
-host.user.hash:
- dashed_name: host-user-hash
- description: 'Unique user hash to correlate information for a user in anonymized
- form.
-
- Useful if `user.id` or `user.name` contain confidential information and cannot
- be used.'
- flat_name: host.user.hash
- ignore_above: 1024
- level: extended
- name: hash
- normalize: []
- original_fieldset: user
- short: Unique user hash to correlate information for a user in anonymized form.
- type: keyword
-host.user.id:
- dashed_name: host-user-id
- description: Unique identifier of the user.
- flat_name: host.user.id
- ignore_above: 1024
- level: core
- name: id
- normalize: []
- original_fieldset: user
- short: Unique identifier of the user.
- type: keyword
-host.user.name:
- dashed_name: host-user-name
- description: Short name or login of the user.
- example: albert
- flat_name: host.user.name
- level: core
- multi_fields:
- - flat_name: host.user.name.text
- name: text
- norms: false
- type: text
- name: name
- normalize: []
- original_fieldset: user
- short: Short name or login of the user.
- type: wildcard
-host.user.roles:
- dashed_name: host-user-roles
- description: Array of user roles at the time of the event.
- example: '["kibana_admin", "reporting_user"]'
- flat_name: host.user.roles
- ignore_above: 1024
- level: extended
- name: roles
- normalize:
- - array
- original_fieldset: user
- short: Array of user roles at the time of the event.
- type: keyword
 http.request.body.bytes:
  dashed_name: http-request-body-bytes
  description: Size in bytes of the request body.