Skip to content

Commit 006ac9b

Browse files
efd6efd6
committed
claude_code: adopt gen_ai.* fields and fix event.category assignments
Map custom fields to their ECS gen_ai.* equivalents (model, tokens, cache, tool name/id/arguments, operation, provider) and to ECS core fields (error.code, error.type, organization.id, user.email, user.id). error.message is intentionally excluded due to elastic-package overloading the field. Fix event.category per event type: api_* events use "api" instead of "web"; tool_decision uses "iam" with allowed/denied type derived from the decision attribute; user_prompt and skill_activated drop their category (no closed-vocab value fits); hook_registered moves to "configuration"; hook_execution_start/complete get proper start/end types; plugin_loaded moves to "library". Derive event.outcome from the decision field for tool_decision events (accept=success, reject=failure) instead of leaving it unknown.
1 parent 696f576 commit 006ac9b

25 files changed

Lines changed: 604 additions & 356 deletions

‎packages/claude_code/_dev/build/docs/README.md‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,18 +25,18 @@ The integration processes these event types:
2525
| Event | Description | ECS category |
2626
|-------|-------------|--------------|
2727
| `tool_result` | Tool execution outcome (success/failure, duration, parameters). | `process` |
28-
| `tool_decision` | Permission decision for a tool call (accept/reject, source). | `process` |
29-
| `api_request` | API call to Anthropic (model, cost, tokens, duration). | `web` |
30-
| `user_prompt` | User prompt submission (length, command, optionally text). | `process` |
31-
| `api_error` | API request failure (error, status code, retry attempt). | `web` |
32-
| `api_refusal` | Content safety refusal from the model. | `web` |
28+
| `tool_decision` | Permission decision for a tool call (accept/reject, source). | `iam` |
29+
| `api_request` | API call to Anthropic (model, cost, tokens, duration). | `api` |
30+
| `user_prompt` | User prompt submission (length, command, optionally text). | — |
31+
| `api_error` | API request failure (error, status code, retry attempt). | `api` |
32+
| `api_refusal` | Content safety refusal from the model. | `api` |
3333
| `permission_mode_changed` | Permission mode change (from/to mode, trigger). | `configuration` |
3434
| `mcp_server_connection` | MCP server connection attempt (status, transport type). | `network` |
35-
| `hook_registered` | Hook registration (name, event type, matcher). | `process` |
35+
| `hook_registered` | Hook registration (name, event type, matcher). | `configuration` |
3636
| `hook_execution_start` | Hook execution start. | `process` |
3737
| `hook_execution_complete` | Hook execution result (success/failure counts, duration). | `process` |
38-
| `plugin_loaded` | Plugin loaded (name, scope, paths). | `package` |
39-
| `skill_activated` | Skill activation (name, source, trigger). | `process` |
38+
| `plugin_loaded` | Plugin loaded (name, scope, paths). | `library` |
39+
| `skill_activated` | Skill activation (name, source, trigger). | — |
4040

4141
## What do I need to use this integration?
4242

‎packages/claude_code/_dev/test/config.yml‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎packages/claude_code/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
- version: "0.2.0"
2+
changes:
3+
- description: Map fields to ECS gen_ai.* fieldset and core ECS fields; fix event.category assignments per event type.
4+
type: enhancement
5+
link: https://github.com/elastic/integrations/pull/19968
16
- version: "0.1.0"
27
changes:
38
- description: Initial release.

‎packages/claude_code/data_stream/events/_dev/test/pipeline/test-api-request-title.json-expected.json‎

Lines changed: 35 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,27 +4,16 @@
44
"@timestamp": "2026-06-22T02:16:30.437Z",
55
"claude_code": {
66
"events": {
7-
"cache_creation_tokens": 0,
8-
"cache_read_tokens": 0,
97
"cost_usd": 5.03E-4,
108
"cost_usd_micros": 503,
11-
"duration_ms": 1179,
129
"event": {
1310
"name": "api_request",
1411
"sequence": 16,
1512
"timestamp": "2026-06-22T02:16:30.437Z"
1613
},
17-
"input_tokens": 443,
18-
"model": "claude-haiku-4-5-20251001",
19-
"organization": {
20-
"id": "00000000-0000-0000-0000-000000000001"
21-
},
22-
"output_tokens": 12,
2314
"prompt": {
2415
"id": "11111111-2222-3333-4444-555555555555"
2516
},
26-
"query_source": "generate_session_title",
27-
"request_id": "req_01ExampleRequestId0000000",
2817
"session": {
2918
"id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
3019
},
@@ -34,9 +23,7 @@
3423
},
3524
"user": {
3625
"account_id": "user_01ExampleAccountId00000",
37-
"account_uuid": "00000000-1111-2222-3333-444444444444",
38-
"email": "alice@example.com",
39-
"id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
26+
"account_uuid": "00000000-1111-2222-3333-444444444444"
4027
}
4128
}
4229
},
@@ -51,7 +38,7 @@
5138
"event": {
5239
"action": "api_request",
5340
"category": [
54-
"web"
41+
"api"
5542
],
5643
"duration": 1179000000,
5744
"kind": "event",
@@ -62,7 +49,35 @@
6249
"info"
6350
]
6451
},
52+
"gen_ai": {
53+
"operation": {
54+
"name": "generate_session_title"
55+
},
56+
"provider": {
57+
"name": "anthropic"
58+
},
59+
"request": {
60+
"model": "claude-haiku-4-5-20251001"
61+
},
62+
"response": {
63+
"id": "req_01ExampleRequestId0000000",
64+
"model": "claude-haiku-4-5-20251001"
65+
},
66+
"usage": {
67+
"cache_creation": {
68+
"input_tokens": 0
69+
},
70+
"cache_read": {
71+
"input_tokens": 0
72+
},
73+
"input_tokens": 443,
74+
"output_tokens": 12
75+
}
76+
},
6577
"observed_timestamp": "2026-06-22T02:16:30.437Z",
78+
"organization": {
79+
"id": "00000000-0000-0000-0000-000000000001"
80+
},
6681
"related": {
6782
"user": [
6883
"alice@example.com",
@@ -84,7 +99,11 @@
8499
},
85100
"tags": [
86101
"preserve_original_event"
87-
]
102+
],
103+
"user": {
104+
"email": "alice@example.com",
105+
"id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
106+
}
88107
}
89108
]
90109
}

‎packages/claude_code/data_stream/events/_dev/test/pipeline/test-api-request.json-expected.json‎

Lines changed: 35 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,28 +4,17 @@
44
"@timestamp": "2026-06-22T02:16:31.758Z",
55
"claude_code": {
66
"events": {
7-
"cache_creation_tokens": 16935,
8-
"cache_read_tokens": 17241,
97
"cost_usd": 0.1068663,
108
"cost_usd_micros": 106866,
11-
"duration_ms": 2493,
129
"effort": "high",
1310
"event": {
1411
"name": "api_request",
1512
"sequence": 17,
1613
"timestamp": "2026-06-22T02:16:31.758Z"
1714
},
18-
"input_tokens": 3,
19-
"model": "claude-sonnet-4-6",
20-
"organization": {
21-
"id": "00000000-0000-0000-0000-000000000001"
22-
},
23-
"output_tokens": 5,
2415
"prompt": {
2516
"id": "11111111-2222-3333-4444-555555555555"
2617
},
27-
"query_source": "repl_main_thread",
28-
"request_id": "req_01ExampleRequestId0000000",
2918
"session": {
3019
"id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
3120
},
@@ -35,9 +24,7 @@
3524
},
3625
"user": {
3726
"account_id": "user_01ExampleAccountId00000",
38-
"account_uuid": "00000000-1111-2222-3333-444444444444",
39-
"email": "alice@example.com",
40-
"id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
27+
"account_uuid": "00000000-1111-2222-3333-444444444444"
4128
}
4229
}
4330
},
@@ -52,7 +39,7 @@
5239
"event": {
5340
"action": "api_request",
5441
"category": [
55-
"web"
42+
"api"
5643
],
5744
"duration": 2493000000,
5845
"kind": "event",
@@ -63,7 +50,35 @@
6350
"info"
6451
]
6552
},
53+
"gen_ai": {
54+
"operation": {
55+
"name": "repl_main_thread"
56+
},
57+
"provider": {
58+
"name": "anthropic"
59+
},
60+
"request": {
61+
"model": "claude-sonnet-4-6"
62+
},
63+
"response": {
64+
"id": "req_01ExampleRequestId0000000",
65+
"model": "claude-sonnet-4-6"
66+
},
67+
"usage": {
68+
"cache_creation": {
69+
"input_tokens": 16935
70+
},
71+
"cache_read": {
72+
"input_tokens": 17241
73+
},
74+
"input_tokens": 3,
75+
"output_tokens": 5
76+
}
77+
},
6678
"observed_timestamp": "2026-06-22T02:16:31.758Z",
79+
"organization": {
80+
"id": "00000000-0000-0000-0000-000000000001"
81+
},
6782
"related": {
6883
"user": [
6984
"alice@example.com",
@@ -85,7 +100,11 @@
85100
},
86101
"tags": [
87102
"preserve_original_event"
88-
]
103+
],
104+
"user": {
105+
"email": "alice@example.com",
106+
"id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
107+
}
89108
}
90109
]
91110
}

‎packages/claude_code/data_stream/events/_dev/test/pipeline/test-hook-execution-complete.json-expected.json‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,6 @@
1818
"num_hooks": 2,
1919
"num_non_blocking_error": 0,
2020
"num_success": 2,
21-
"organization": {
22-
"id": "00000000-0000-0000-0000-000000000001"
23-
},
2421
"safe_mode": "false",
2522
"session": {
2623
"id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
@@ -31,9 +28,7 @@
3128
"total_duration_ms": 162,
3229
"user": {
3330
"account_id": "user_01ExampleAccountId00000",
34-
"account_uuid": "00000000-1111-2222-3333-444444444444",
35-
"email": "alice@example.com",
36-
"id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
31+
"account_uuid": "00000000-1111-2222-3333-444444444444"
3732
}
3833
}
3934
},
@@ -55,10 +50,18 @@
5550
"outcome": "unknown",
5651
"provider": "claude-code",
5752
"type": [
58-
"info"
53+
"end"
5954
]
6055
},
56+
"gen_ai": {
57+
"provider": {
58+
"name": "anthropic"
59+
}
60+
},
6161
"observed_timestamp": "2026-06-22T02:16:23.969Z",
62+
"organization": {
63+
"id": "00000000-0000-0000-0000-000000000001"
64+
},
6265
"related": {
6366
"user": [
6467
"alice@example.com",
@@ -80,7 +83,11 @@
8083
},
8184
"tags": [
8285
"preserve_original_event"
83-
]
86+
],
87+
"user": {
88+
"email": "alice@example.com",
89+
"id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
90+
}
8491
}
8592
]
8693
}

‎packages/claude_code/data_stream/events/_dev/test/pipeline/test-hook-execution-start.json-expected.json‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,6 @@
1414
"hook_source": "merged",
1515
"managed_only": "false",
1616
"num_hooks": 2,
17-
"organization": {
18-
"id": "00000000-0000-0000-0000-000000000001"
19-
},
2017
"safe_mode": "false",
2118
"session": {
2219
"id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
@@ -26,9 +23,7 @@
2623
},
2724
"user": {
2825
"account_id": "user_01ExampleAccountId00000",
29-
"account_uuid": "00000000-1111-2222-3333-444444444444",
30-
"email": "alice@example.com",
31-
"id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
26+
"account_uuid": "00000000-1111-2222-3333-444444444444"
3227
}
3328
}
3429
},
@@ -50,10 +45,18 @@
5045
"outcome": "unknown",
5146
"provider": "claude-code",
5247
"type": [
53-
"info"
48+
"start"
5449
]
5550
},
51+
"gen_ai": {
52+
"provider": {
53+
"name": "anthropic"
54+
}
55+
},
5656
"observed_timestamp": "2026-06-22T02:16:23.732Z",
57+
"organization": {
58+
"id": "00000000-0000-0000-0000-000000000001"
59+
},
5760
"related": {
5861
"user": [
5962
"alice@example.com",
@@ -75,7 +78,11 @@
7578
},
7679
"tags": [
7780
"preserve_original_event"
78-
]
81+
],
82+
"user": {
83+
"email": "alice@example.com",
84+
"id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
85+
}
7986
}
8087
]
8188
}

0 commit comments

Comments
 (0)