[APM] Searching for aligned ECS field storing the meta type of an event

@ruflin , @graphaelli and I were discussing offline what would be the proper field to indicate that an event is an apm event. In the future we might want to query events across different shippers, e.g. combine filebeat metrics with apm metrics, etc. Therefore it would be interesting if there exists a cross-team aligned field that we should use for this type of information, so more concrete apm, metricbeat, filebeat, etc.

There were different thoughts around existing ECS fields:

• agent.type: Unclear if generic apm information should be stored in the agent key.
• event.type: If used, then this should rather contain the information about which apm event type it is span, transaction, metric, error.
• event.module: If used, then this seems to correlate rather to information collected by apm agents, e.g. a mysql query, or an outgoing http request etc.
• event.dataset: Is APM one big module? Not sure on how that would fit.

[ruflin]

@simitt Was a starting thought, nothing specific yet. We can add dataset to apm at any time later.

[jamiehynds]

Closing due to in activity, but can re-open or create a new issue for APM mappings if required.