{"host": "clouddumps1001.wikimedia.org", "state": "core_diff", "description": "Differences to core resources", "diff": {"full": {"total": 3735, "only_in_self": [], "only_in_other": [], "resource_diffs": [{"resource": "File[/etc/nginx/sites-available/xmldumps]", "content": "--- /etc/nginx/sites-available/xmldumps.orig\n+++ /etc/nginx/sites-available/xmldumps\n@@ -33,7 +33,9 @@\n # This directive configures the ECS compatible JSON log format.\n # The '$schema', 'meta' and 'dt' fields are required by the Event Platform so that\n # these events can be ingested into the Data Lake (see T291645). 'dt' is the Event\n-# Platform time field; '@timestamp' is retained for ECS compatibility.\n+# Platform time field. Event Platform schemas cannot contain an '@' in field names,\n+# so '@timestamp' is intentionally not emitted; logstash sets its own @timestamp\n+# when indexing into OpenSearch.\n log_format ecs_json escape=json\n     '{'\n         '\"${dollar}schema\":\"/development/elastic/ecs/1.0.0\",'\n@@ -44,13 +46,12 @@\n             '\"domain\":\"$host\"'\n         '},'\n         '\"dt\":\"$time_iso8601\",'\n-        '\"@timestamp\":\"$time_iso8601\",'\n         '\"ecs\":{\"version\":\"1.11.0\"},'\n         '\"event\":{'\n             '\"dataset\":\"dumps.access\",'\n             '\"kind\":\"event\",'\n-            '\"category\":\"web\",'\n-            '\"type\":\"access\",'\n+            '\"category\":[\"web\"],'\n+            '\"type\":[\"access\"],'\n             '\"outcome\":\"$ecs_event_outcome\"'\n         '},'\n         '\"http\":{'"}, {"resource": "Nginx::Site[xmldumps]"}], "perc_changed": "0.05%"}, "core": {"total": 3735, "only_in_self": [], "only_in_other": [], "resource_diffs": [{"resource": "File[/etc/nginx/sites-available/xmldumps]", "content": "--- /etc/nginx/sites-available/xmldumps.orig\n+++ /etc/nginx/sites-available/xmldumps\n@@ -33,7 +33,9 @@\n # This directive configures the ECS compatible JSON log format.\n # The '$schema', 'meta' and 'dt' fields are required by the Event Platform so that\n # these events can be ingested into the Data Lake (see T291645). 'dt' is the Event\n-# Platform time field; '@timestamp' is retained for ECS compatibility.\n+# Platform time field. Event Platform schemas cannot contain an '@' in field names,\n+# so '@timestamp' is intentionally not emitted; logstash sets its own @timestamp\n+# when indexing into OpenSearch.\n log_format ecs_json escape=json\n     '{'\n         '\"${dollar}schema\":\"/development/elastic/ecs/1.0.0\",'\n@@ -44,13 +46,12 @@\n             '\"domain\":\"$host\"'\n         '},'\n         '\"dt\":\"$time_iso8601\",'\n-        '\"@timestamp\":\"$time_iso8601\",'\n         '\"ecs\":{\"version\":\"1.11.0\"},'\n         '\"event\":{'\n             '\"dataset\":\"dumps.access\",'\n             '\"kind\":\"event\",'\n-            '\"category\":\"web\",'\n-            '\"type\":\"access\",'\n+            '\"category\":[\"web\"],'\n+            '\"type\":[\"access\"],'\n             '\"outcome\":\"$ecs_event_outcome\"'\n         '},'\n         '\"http\":{'"}], "perc_changed": "0.03%"}, "main": {"total": 3735, "only_in_self": [], "only_in_other": [], "resource_diffs": [{"resource": "Nginx::Site[xmldumps]"}, {"resource": "File[/etc/nginx/sites-available/xmldumps]", "content": "--- /etc/nginx/sites-available/xmldumps.orig\n+++ /etc/nginx/sites-available/xmldumps\n@@ -33,7 +33,9 @@\n # This directive configures the ECS compatible JSON log format.\n # The '$schema', 'meta' and 'dt' fields are required by the Event Platform so that\n # these events can be ingested into the Data Lake (see T291645). 'dt' is the Event\n-# Platform time field; '@timestamp' is retained for ECS compatibility.\n+# Platform time field. Event Platform schemas cannot contain an '@' in field names,\n+# so '@timestamp' is intentionally not emitted; logstash sets its own @timestamp\n+# when indexing into OpenSearch.\n log_format ecs_json escape=json\n     '{'\n         '\"${dollar}schema\":\"/development/elastic/ecs/1.0.0\",'\n@@ -44,13 +46,12 @@\n             '\"domain\":\"$host\"'\n         '},'\n         '\"dt\":\"$time_iso8601\",'\n-        '\"@timestamp\":\"$time_iso8601\",'\n         '\"ecs\":{\"version\":\"1.11.0\"},'\n         '\"event\":{'\n             '\"dataset\":\"dumps.access\",'\n             '\"kind\":\"event\",'\n-            '\"category\":\"web\",'\n-            '\"type\":\"access\",'\n+            '\"category\":[\"web\"],'\n+            '\"type\":[\"access\"],'\n             '\"outcome\":\"$ecs_event_outcome\"'\n         '},'\n         '\"http\":{'"}], "perc_changed": "0.05%"}}}