elasticsearch

type Data struct {
	// The timestamp in nanosecond resolution
	Timestamp uint64
	// Organization ID
	OrgID       string
	DatasetType string
	// The datasetID
	DatasetID string
	// The stringified path
	Path string
	// The codec encoded key
	Key []byte
	// The key data
	// this array will have each entry as an object with "name" field
	// and "<type>" field for value.
	// If name is not set, the data is put in one of the simple type fields
	// The problem with nested types is that each entry in the array is creating a doc
	// and the number of docs is exploding which is not good.
	// So one optimization is to flatten for simple values and not use the nested field.
	KeyData   []*field `json:",omitempty"`
	KeyString *string  `json:",omitempty"`
	KeyDouble *float64 `json:",omitempty"`
	KeyLong   *int64   `json:",omitempty"`
	KeyBool   *bool    `json:",omitempty"`
	KeyPtr    *string  `json:",omitempty"`
	// If the simple string looks like an ip address
	// we also index it here as ip address
	KeyIP string `json:",omitempty"`
	// If the simple string looks like a mac address
	// we also index it here as mac address
	KeyMAC string `json:",omitempty"`
	// The value data
	// this array will have each entry as an object with "name" field
	// and "<type>" field for value.
	// If name is not set, the data was a simple value
	// The problem with nested types is that each entry in the array is creating a doc
	// and the number of docs is exploding which is not good.
	// So one optimization is to flatten for simple values and not use the nested field.
	Value       []*field `json:",omitempty"`
	ValueString *string  `json:",omitempty"`
	ValueDouble *float64 `json:",omitempty"`
	ValueLong   *int64   `json:",omitempty"`
	ValueBool   *bool    `json:",omitempty"`
	ValuePtr    *string  `json:",omitempty"`
	// If the simple string looks like an ip address
	// we also index it here as ip address
	ValueIP string `json:",omitempty"`
	// If the simple string looks like a mac address
	// we also index it here as mac address
	ValueMAC string `json:",omitempty"`

	// Present when it's a delete
	// In this case, value will not be present
	Del *bool `json:",omitempty"`
	// Present when it's a deleteAll
	// In this case, key and value will not be present
	DelAll *bool `json:",omitempty"`
}