ecs.ndjson

{"@timestamp": "2026-08-11T09:15:00Z", "ecs": {"version": "8.11.0"}, "message": "Connection denied", "event": {"action": "connection_denied", "category": ["network"], "code": "FW-1001", "severity": 7, "outcome": "failure"}, "host": {"name": "fw01.example.com"}, "source": {"ip": "10.1.1.1", "port": 51515, "user": {"name": "alice"}}, "destination": {"ip": "203.0.113.9", "port": 443}, "network": {"transport": "tcp"}, "rule": {"name": "deny-outbound"}}
{"@timestamp": "2026-08-11T09:16:12Z", "ecs": {"version": "8.11.0"}, "message": "User logged in", "event": {"action": "user_login", "category": ["authentication"], "outcome": "success"}, "log": {"level": "info"}, "host": {"name": "app01.example.com"}, "source": {"ip": "192.0.2.44"}, "user": {"name": "bob"}}