Microsoft Exchange Server Modeling Rule

Modeling Rule

Microsoft Exchange Server

Details

IDmicrosoft_exchange_server_modeling_rule
From Version6.10.0
Tagsmicrosoft

Schema

msft_exchange_raw

Field Type Array?
client_hostname string
client_ip string
date_time datetime
event_id string
internal_message_id string
message_id string
message_info string
message_subject string
network_message_id string
recipient_address string
return_path string
schema_version string
sender_address string
server_hostname string
server_ip string
tenant_id string
{
    "msft_exchange_raw": {
        "date_time": {
            "type": "datetime",
            "is_array": false
        },
        "client_ip": {
            "type": "string",
            "is_array": false
        },
        "client_hostname": {
            "type": "string",
            "is_array": false
        },
        "server_ip": {
            "type": "string",
            "is_array": false
        },
        "server_hostname": {
            "type": "string",
            "is_array": false
        },
        "event_id": {
            "type": "string",
            "is_array": false
        },
        "internal_message_id": {
            "type": "string",
            "is_array": false
        },
        "message_id": {
            "type": "string",
            "is_array": false
        },
        "network_message_id": {
            "type": "string",
            "is_array": false
        },
        "recipient_address": {
            "type": "string",
            "is_array": false
        },
        "message_subject": {
            "type": "string",
            "is_array": false
        },
        "sender_address": {
            "type": "string",
            "is_array": false
        },
        "return_path": {
            "type": "string",
            "is_array": false
        },
        "message_info": {
            "type": "string",
            "is_array": false
        },
        "tenant_id": {
            "type": "string",
            "is_array": false
        },
        "schema_version": {
            "type": "string",
            "is_array": false
        }
    }
}