Fix description of syslog.severity.name and syslog.severity.code

CHANGELOG.next.md

@@ -14,6 +14,8 @@ Thanks, you're awesome :-) -->
 
 #### Bugfixes
 
+Updated description for 'syslog.severity.name' to clarify that the type is text-based. #2290
+
 #### Added
 
 #### Improvements
@@ -30,6 +32,8 @@ Thanks, you're awesome :-) -->
 
 #### Improvements
 
+
+
 #### Deprecated
 
 

docs/fields/field-details.asciidoc

@@ -5910,7 +5910,7 @@ example: `3`
 [[field-log-syslog-severity-name]]
 <<field-log-syslog-severity-name, log.syslog.severity.name>>
 
-a| The Syslog numeric severity of the log event, if available.
+a| The Syslog text-based severity of the log event, if available.
 
 If the event source publishing via Syslog provides a different severity value (e.g. firewall, IDS), your source's text severity should go to `log.level`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `log.level`.
 

experimental/generated/beats/fields.ecs.yml

@@ -3965,7 +3965,7 @@
       level: extended
       type: keyword
       ignore_above: 1024
-      description: 'The Syslog numeric severity of the log event, if available.
+      description: 'The Syslog text-based severity of the log event, if available.
 
         If the event source publishing via Syslog provides a different severity value
         (e.g. firewall, IDS), your source''s text severity should go to `log.level`.

experimental/generated/ecs/ecs_flat.yml

@@ -6502,7 +6502,7 @@ log.syslog.severity.code:
   type: long
 log.syslog.severity.name:
   dashed_name: log-syslog-severity-name
-  description: 'The Syslog numeric severity of the log event, if available.
+  description: 'The Syslog text-based severity of the log event, if available.
 
     If the event source publishing via Syslog provides a different severity value
     (e.g. firewall, IDS), your source''s text severity should go to `log.level`. If

experimental/generated/ecs/ecs_nested.yml

@@ -7990,7 +7990,7 @@ log:
       type: long
     log.syslog.severity.name:
       dashed_name: log-syslog-severity-name
-      description: 'The Syslog numeric severity of the log event, if available.
+      description: 'The Syslog text-based severity of the log event, if available.
 
         If the event source publishing via Syslog provides a different severity value
         (e.g. firewall, IDS), your source''s text severity should go to `log.level`.

generated/beats/fields.ecs.yml

@@ -3915,7 +3915,7 @@
       level: extended
       type: keyword
       ignore_above: 1024
-      description: 'The Syslog numeric severity of the log event, if available.
+      description: 'The Syslog text-based severity of the log event, if available.
 
         If the event source publishing via Syslog provides a different severity value
         (e.g. firewall, IDS), your source''s text severity should go to `log.level`.

generated/ecs/ecs_flat.yml

@@ -6433,7 +6433,7 @@ log.syslog.severity.code:
   type: long
 log.syslog.severity.name:
   dashed_name: log-syslog-severity-name
-  description: 'The Syslog numeric severity of the log event, if available.
+  description: 'The Syslog text-based severity of the log event, if available.
 
     If the event source publishing via Syslog provides a different severity value
     (e.g. firewall, IDS), your source''s text severity should go to `log.level`. If

generated/ecs/ecs_nested.yml

@@ -7910,7 +7910,7 @@ log:
       type: long
     log.syslog.severity.name:
       dashed_name: log-syslog-severity-name
-      description: 'The Syslog numeric severity of the log event, if available.
+      description: 'The Syslog text-based severity of the log event, if available.
 
         If the event source publishing via Syslog provides a different severity value
         (e.g. firewall, IDS), your source''s text severity should go to `log.level`.

schemas/log.yml

@@ -119,7 +119,7 @@
       example: Error
       short: Syslog text-based severity of the event.
       description: >
-        The Syslog numeric severity of the log event, if available.
+        The Syslog text-based severity of the log event, if available.
 
         If the event source publishing via Syslog provides a different severity
         value (e.g. firewall, IDS), your source's text severity should go to `log.level`.