From 5a135e1873d936fd82bb38f3b10030cea1e3d216 Mon Sep 17 00:00:00 2001
From: Dan Kortschak <dan.kortschak@elastic.co>
Date: Tue, 15 Nov 2022 15:00:21 +1030
Subject: [PATCH] radware,slack,sophos,squid,suricata,symantec,ti_*,tomcat:
 remove duplicate fields

---
 packages/radware/changelog.yml                         |  5 +++++
 .../data_stream/defensepro/fields/base-fields.yml      |  8 --------
 packages/radware/manifest.yml                          |  2 +-
 packages/slack/changelog.yml                           |  5 +++++
 packages/slack/data_stream/audit/fields/ecs.yml        | 10 ----------
 packages/slack/data_stream/audit/fields/fields.yml     |  5 -----
 packages/slack/docs/README.md                          |  2 +-
 packages/slack/manifest.yml                            |  2 +-
 packages/sophos/changelog.yml                          |  5 +++++
 packages/sophos/data_stream/utm/fields/base-fields.yml |  5 -----
 packages/sophos/data_stream/xg/fields/fields.yml       |  4 ----
 packages/sophos/docs/README.md                         |  2 +-
 packages/sophos/manifest.yml                           |  2 +-
 packages/squid/changelog.yml                           |  5 +++++
 packages/squid/data_stream/log/fields/base-fields.yml  |  8 --------
 packages/squid/data_stream/log/fields/ecs.yml          |  2 --
 packages/squid/manifest.yml                            |  2 +-
 packages/suricata/changelog.yml                        |  5 +++++
 packages/suricata/data_stream/eve/fields/agent.yml     |  4 +---
 .../suricata/data_stream/eve/fields/base-fields.yml    |  3 ---
 packages/suricata/data_stream/eve/fields/ecs.yml       |  2 --
 packages/suricata/manifest.yml                         |  2 +-
 packages/symantec_endpoint/changelog.yml               |  5 +++++
 .../symantec_endpoint/data_stream/log/fields/agent.yml |  5 +----
 .../symantec_endpoint/data_stream/log/fields/ecs.yml   |  2 --
 packages/symantec_endpoint/manifest.yml                |  2 +-
 packages/ti_cybersixgill/changelog.yml                 |  5 +++++
 .../ti_cybersixgill/data_stream/threat/fields/ecs.yml  |  2 --
 packages/ti_cybersixgill/manifest.yml                  |  2 +-
 packages/ti_threatq/changelog.yml                      |  5 +++++
 .../data_stream/threat/fields/base-fields.yml          |  4 ----
 packages/ti_threatq/manifest.yml                       |  2 +-
 packages/tomcat/changelog.yml                          |  5 +++++
 packages/tomcat/data_stream/log/fields/base-fields.yml |  3 ---
 packages/tomcat/data_stream/log/fields/ecs.yml         |  2 --
 packages/tomcat/docs/README.md                         |  2 +-
 packages/tomcat/manifest.yml                           |  2 +-
 37 files changed, 59 insertions(+), 79 deletions(-)

diff --git a/packages/radware/changelog.yml b/packages/radware/changelog.yml
index 817b4bc70fe..dc67f01b899 100644
--- a/packages/radware/changelog.yml
+++ b/packages/radware/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.10.1"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4642
 - version: "0.10.0"
   changes:
     - description: Update package to ECS 8.5.0.
diff --git a/packages/radware/data_stream/defensepro/fields/base-fields.yml b/packages/radware/data_stream/defensepro/fields/base-fields.yml
index 2070b87dc06..e64eec82c49 100644
--- a/packages/radware/data_stream/defensepro/fields/base-fields.yml
+++ b/packages/radware/data_stream/defensepro/fields/base-fields.yml
@@ -15,9 +15,6 @@
   type: constant_keyword
   description: Event dataset
   value: radware.defensepro
-- name: '@timestamp'
-  type: date
-  description: Event timestamp.
 - name: container.id
   description: Unique container id.
   ignore_above: 1024
@@ -39,8 +36,3 @@
 - name: log.offset
   description: Offset of the entry in the log file.
   type: long
-- name: tags
-  description: List of keywords used to tag each event.
-  example: '["production", "env2"]'
-  ignore_above: 1024
-  type: keyword
diff --git a/packages/radware/manifest.yml b/packages/radware/manifest.yml
index d37dfb13ca7..32aff91b6c3 100644
--- a/packages/radware/manifest.yml
+++ b/packages/radware/manifest.yml
@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: radware
 title: Radware DefensePro Logs
-version: "0.10.0"
+version: "0.10.1"
 description: Collect defensePro logs from Radware devices with Elastic Agent.
 categories: ["security"]
 release: experimental
diff --git a/packages/slack/changelog.yml b/packages/slack/changelog.yml
index f8a7926205d..10b9c593093 100644
--- a/packages/slack/changelog.yml
+++ b/packages/slack/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.2.1"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4642
 - version: "0.2.0"
   changes:
     - description: Update package to ECS 8.5.0.
diff --git a/packages/slack/data_stream/audit/fields/ecs.yml b/packages/slack/data_stream/audit/fields/ecs.yml
index 555c90df706..75e26d1c53d 100644
--- a/packages/slack/data_stream/audit/fields/ecs.yml
+++ b/packages/slack/data_stream/audit/fields/ecs.yml
@@ -6,8 +6,6 @@
   external: ecs
 - name: event.id
   external: ecs
-- name: event.category
-  external: ecs
 - name: event.type
   external: ecs
 - name: event.category
@@ -56,22 +54,14 @@
   external: ecs
 - external: ecs
   name: user_agent.device.name
-- external: ecs
-  name: user_agent.device.name
-- external: ecs
-  name: user_agent.name
 - external: ecs
   name: user_agent.name
 - external: ecs
   name: user_agent.original
-- external: ecs
-  name: user_agent.original
 - external: ecs
   name: user_agent.os.full
 - external: ecs
   name: user_agent.os.name
-- external: ecs
-  name: user_agent.os.name
 - external: ecs
   name: user_agent.os.version
 - external: ecs
diff --git a/packages/slack/data_stream/audit/fields/fields.yml b/packages/slack/data_stream/audit/fields/fields.yml
index cd8a9e41051..8ac4fb5bb30 100644
--- a/packages/slack/data_stream/audit/fields/fields.yml
+++ b/packages/slack/data_stream/audit/fields/fields.yml
@@ -130,11 +130,6 @@
           description: >
             The timestamp of the entity when entity_type is message
 
-        - name: timestamp
-          type: date
-          description: >
-            The timestamp of the entity when entity_type is message
-
         - name: type
           type: keyword
           description: >-
diff --git a/packages/slack/docs/README.md b/packages/slack/docs/README.md
index f73bdb99719..64eff109b27 100644
--- a/packages/slack/docs/README.md
+++ b/packages/slack/docs/README.md
@@ -112,7 +112,7 @@ Audit logs summarize the history of changes made within the Slack Enterprise.
 | slack.audit.entity.scopes | The OAuth scopes when entity_type is app | keyword |
 | slack.audit.entity.team | Team that the entity exists within when entity_type is user or message | keyword |
 | slack.audit.entity.teams_shared_with | List of orgs channel is shared with when entity_type is channel | keyword |
-| slack.audit.entity.timestamp | The timestamp of the entity when entity_type is message | date |
+| slack.audit.entity.timestamp | The timestamp of the entity when entity_type is message | keyword |
 | slack.audit.entity.title | Title of the entity when entity_type is file | keyword |
 | slack.audit.entity.type | The type of the entity when entity_type is role | keyword |
 | source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword |
diff --git a/packages/slack/manifest.yml b/packages/slack/manifest.yml
index fc66f9ddfd8..a4d227bd409 100644
--- a/packages/slack/manifest.yml
+++ b/packages/slack/manifest.yml
@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: slack
 title: "Slack Logs"
-version: "0.2.0"
+version: "0.2.1"
 license: basic
 description: "Slack Logs Integration"
 type: integration
diff --git a/packages/sophos/changelog.yml b/packages/sophos/changelog.yml
index 673556ee21e..87448e9dea4 100644
--- a/packages/sophos/changelog.yml
+++ b/packages/sophos/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.5.1"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4642
 - version: "2.5.0"
   changes:
     - description: Update package to ECS 8.5.0.
diff --git a/packages/sophos/data_stream/utm/fields/base-fields.yml b/packages/sophos/data_stream/utm/fields/base-fields.yml
index cfae8afa1a6..15da1486fe7 100644
--- a/packages/sophos/data_stream/utm/fields/base-fields.yml
+++ b/packages/sophos/data_stream/utm/fields/base-fields.yml
@@ -36,8 +36,3 @@
 - name: log.offset
   description: Offset of the entry in the log file.
   type: long
-- name: tags
-  description: List of keywords used to tag each event.
-  example: '["production", "env2"]'
-  ignore_above: 1024
-  type: keyword
diff --git a/packages/sophos/data_stream/xg/fields/fields.yml b/packages/sophos/data_stream/xg/fields/fields.yml
index 6dd56deeab8..c6f6e8c41dd 100644
--- a/packages/sophos/data_stream/xg/fields/fields.yml
+++ b/packages/sophos/data_stream/xg/fields/fields.yml
@@ -680,10 +680,6 @@
           type: keyword
           description: |
             Email subject
-        - name: syslog_server_name
-          type: keyword
-          description: |
-            Syslog server name
         - name: syslog_server_name
           type: keyword
           description: |
diff --git a/packages/sophos/docs/README.md b/packages/sophos/docs/README.md
index 9074dfc20b0..fd2fd9b974d 100644
--- a/packages/sophos/docs/README.md
+++ b/packages/sophos/docs/README.md
@@ -1236,7 +1236,7 @@ An example event for `xg` looks as following:
 | sophos.xg.status | Ultimate status of traffic – Allowed or Denied | keyword |
 | sophos.xg.status_code | Status code | keyword |
 | sophos.xg.subject | Email subject | keyword |
-| sophos.xg.syslog_server_name | Syslog server name | keyword |
+| sophos.xg.syslog_server_name | Syslog server name. | keyword |
 | sophos.xg.system_cpu | system | float |
 | sophos.xg.target | Platform of the traffic. | keyword |
 | sophos.xg.temp | Temp | float |
diff --git a/packages/sophos/manifest.yml b/packages/sophos/manifest.yml
index ae320da679e..3d5dae27917 100644
--- a/packages/sophos/manifest.yml
+++ b/packages/sophos/manifest.yml
@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: sophos
 title: Sophos
-version: "2.5.0"
+version: "2.5.1"
 description: Collect logs from Sophos with Elastic Agent.
 categories: ["security"]
 release: ga
diff --git a/packages/squid/changelog.yml b/packages/squid/changelog.yml
index 30dc1493948..dbf27e76cc0 100644
--- a/packages/squid/changelog.yml
+++ b/packages/squid/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.11.1"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4642
 - version: "0.11.0"
   changes:
     - description: Update package to ECS 8.5.0.
diff --git a/packages/squid/data_stream/log/fields/base-fields.yml b/packages/squid/data_stream/log/fields/base-fields.yml
index 8243e1ed2f0..c25d7cae586 100644
--- a/packages/squid/data_stream/log/fields/base-fields.yml
+++ b/packages/squid/data_stream/log/fields/base-fields.yml
@@ -15,9 +15,6 @@
   type: constant_keyword
   description: Event dataset
   value: squid.log
-- name: '@timestamp'
-  type: date
-  description: Event timestamp.
 - name: container.id
   description: Unique container id.
   ignore_above: 1024
@@ -39,8 +36,3 @@
 - name: log.offset
   description: Offset of the entry in the log file.
   type: long
-- name: tags
-  description: List of keywords used to tag each event.
-  example: '["production", "env2"]'
-  ignore_above: 1024
-  type: keyword
diff --git a/packages/squid/data_stream/log/fields/ecs.yml b/packages/squid/data_stream/log/fields/ecs.yml
index 0efc8093c7f..01ea097eee8 100644
--- a/packages/squid/data_stream/log/fields/ecs.yml
+++ b/packages/squid/data_stream/log/fields/ecs.yml
@@ -240,8 +240,6 @@
   name: user_agent.name
 - external: ecs
   name: user_agent.original
-- external: ecs
-  name: user_agent.original
 - external: ecs
   name: user_agent.os.family
 - external: ecs
diff --git a/packages/squid/manifest.yml b/packages/squid/manifest.yml
index 11af169780f..832a0671f24 100644
--- a/packages/squid/manifest.yml
+++ b/packages/squid/manifest.yml
@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: squid
 title: Squid Logs
-version: "0.11.0"
+version: "0.11.1"
 description: Collect and parse logs from Squid devices with Elastic Agent.
 categories: ["security"]
 release: experimental
diff --git a/packages/suricata/changelog.yml b/packages/suricata/changelog.yml
index 388f71825ff..f9b99df0d85 100644
--- a/packages/suricata/changelog.yml
+++ b/packages/suricata/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.5.2"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4642
 - version: "2.5.1"
   changes:
     - description: Defensive copy of parameter lists
diff --git a/packages/suricata/data_stream/eve/fields/agent.yml b/packages/suricata/data_stream/eve/fields/agent.yml
index 79a7a39864b..343ffb854cf 100644
--- a/packages/suricata/data_stream/eve/fields/agent.yml
+++ b/packages/suricata/data_stream/eve/fields/agent.yml
@@ -108,9 +108,7 @@
       ignore_above: 1024
       description: "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
     - name: ip
-      level: core
-      type: ip
-      description: Host ip addresses.
+      external: ecs
     - name: mac
       level: core
       type: keyword
diff --git a/packages/suricata/data_stream/eve/fields/base-fields.yml b/packages/suricata/data_stream/eve/fields/base-fields.yml
index eee838550ff..ae4fc87ca44 100644
--- a/packages/suricata/data_stream/eve/fields/base-fields.yml
+++ b/packages/suricata/data_stream/eve/fields/base-fields.yml
@@ -15,6 +15,3 @@
   type: constant_keyword
   description: Event dataset
   value: suricata.eve
-- name: '@timestamp'
-  type: date
-  description: Event timestamp.
diff --git a/packages/suricata/data_stream/eve/fields/ecs.yml b/packages/suricata/data_stream/eve/fields/ecs.yml
index 3058aeaa1d3..fc4952f07b1 100644
--- a/packages/suricata/data_stream/eve/fields/ecs.yml
+++ b/packages/suricata/data_stream/eve/fields/ecs.yml
@@ -50,8 +50,6 @@
   name: file.path
 - external: ecs
   name: file.size
-- external: ecs
-  name: host.ip
 - external: ecs
   name: http.request.method
 - external: ecs
diff --git a/packages/suricata/manifest.yml b/packages/suricata/manifest.yml
index b3f9aef81bb..22ec2103178 100644
--- a/packages/suricata/manifest.yml
+++ b/packages/suricata/manifest.yml
@@ -1,6 +1,6 @@
 name: suricata
 title: Suricata
-version: "2.5.1"
+version: "2.5.2"
 release: ga
 description: Collect logs from Suricata with Elastic Agent.
 type: integration
diff --git a/packages/symantec_endpoint/changelog.yml b/packages/symantec_endpoint/changelog.yml
index fd8ef94fb1e..be2dd3c91ca 100644
--- a/packages/symantec_endpoint/changelog.yml
+++ b/packages/symantec_endpoint/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.1.1"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4642
 - version: "2.1.0"
   changes:
     - description: Update package to ECS 8.5.0.
diff --git a/packages/symantec_endpoint/data_stream/log/fields/agent.yml b/packages/symantec_endpoint/data_stream/log/fields/agent.yml
index c2cceee2d3f..7cf602d34ef 100644
--- a/packages/symantec_endpoint/data_stream/log/fields/agent.yml
+++ b/packages/symantec_endpoint/data_stream/log/fields/agent.yml
@@ -63,10 +63,7 @@
   type: group
   fields:
     - name: id
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: Unique container id.
+      external: ecs
     - name: image.name
       level: extended
       type: keyword
diff --git a/packages/symantec_endpoint/data_stream/log/fields/ecs.yml b/packages/symantec_endpoint/data_stream/log/fields/ecs.yml
index be2445d1e99..48e2d200943 100644
--- a/packages/symantec_endpoint/data_stream/log/fields/ecs.yml
+++ b/packages/symantec_endpoint/data_stream/log/fields/ecs.yml
@@ -1,5 +1,3 @@
-- name: container.id
-  external: ecs
 - name: destination.address
   external: ecs
 - name: destination.as.number
diff --git a/packages/symantec_endpoint/manifest.yml b/packages/symantec_endpoint/manifest.yml
index 825b771e799..b61ce8f531c 100644
--- a/packages/symantec_endpoint/manifest.yml
+++ b/packages/symantec_endpoint/manifest.yml
@@ -1,6 +1,6 @@
 name: symantec_endpoint
 title: Symantec Endpoint Protection
-version: "2.1.0"
+version: "2.1.1"
 release: ga
 description: Collect logs from Symantec Endpoint Protection with Elastic Agent.
 type: integration
diff --git a/packages/ti_cybersixgill/changelog.yml b/packages/ti_cybersixgill/changelog.yml
index b84d45bfad9..63b36c761b5 100644
--- a/packages/ti_cybersixgill/changelog.yml
+++ b/packages/ti_cybersixgill/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.8.1"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4642
 - version: "1.8.0"
   changes:
     - description: Update package to ECS 8.5.0.
diff --git a/packages/ti_cybersixgill/data_stream/threat/fields/ecs.yml b/packages/ti_cybersixgill/data_stream/threat/fields/ecs.yml
index b610ef66549..7e4da707181 100644
--- a/packages/ti_cybersixgill/data_stream/threat/fields/ecs.yml
+++ b/packages/ti_cybersixgill/data_stream/threat/fields/ecs.yml
@@ -16,8 +16,6 @@
   name: event.severity
 - external: ecs
   name: event.created
-- external: ecs
-  name: message
 - external: ecs
   name: tags
 - external: ecs
diff --git a/packages/ti_cybersixgill/manifest.yml b/packages/ti_cybersixgill/manifest.yml
index 0888a5bdf29..47955d84206 100644
--- a/packages/ti_cybersixgill/manifest.yml
+++ b/packages/ti_cybersixgill/manifest.yml
@@ -1,6 +1,6 @@
 name: ti_cybersixgill
 title: Cybersixgill
-version: "1.8.0"
+version: "1.8.1"
 release: ga
 description: Ingest threat intelligence indicators from Cybersixgill with Elastic Agent.
 type: integration
diff --git a/packages/ti_threatq/changelog.yml b/packages/ti_threatq/changelog.yml
index 60b2ddb5134..8310958880d 100644
--- a/packages/ti_threatq/changelog.yml
+++ b/packages/ti_threatq/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.7.1"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4642
 - version: "1.7.0"
   changes:
     - description: Update package to ECS 8.5.0.
diff --git a/packages/ti_threatq/data_stream/threat/fields/base-fields.yml b/packages/ti_threatq/data_stream/threat/fields/base-fields.yml
index 701a58f1514..4f3471fc6f5 100644
--- a/packages/ti_threatq/data_stream/threat/fields/base-fields.yml
+++ b/packages/ti_threatq/data_stream/threat/fields/base-fields.yml
@@ -11,10 +11,6 @@
   type: constant_keyword
   description: Event module
   value: ti_threatq
-- name: threat.feed.name
-  type: constant_keyword
-  description: Display friendly feed name
-  value: ThreatQuotient
 - name: threat.feed.dashboard_id
   type: constant_keyword
   description: Dashboard ID used for Kibana CTI UI
diff --git a/packages/ti_threatq/manifest.yml b/packages/ti_threatq/manifest.yml
index 7eaeb4e61ad..6b4bb44c227 100644
--- a/packages/ti_threatq/manifest.yml
+++ b/packages/ti_threatq/manifest.yml
@@ -1,6 +1,6 @@
 name: ti_threatq
 title: ThreatQuotient
-version: "1.7.0"
+version: "1.7.1"
 release: ga
 description: Ingest threat intelligence indicators from ThreatQuotient with Elastic Agent.
 type: integration
diff --git a/packages/tomcat/changelog.yml b/packages/tomcat/changelog.yml
index 333f70ce13d..8cffaf61488 100644
--- a/packages/tomcat/changelog.yml
+++ b/packages/tomcat/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.7.1"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4642
 - version: "1.7.0"
   changes:
     - description: Update package to ECS 8.5.0.
diff --git a/packages/tomcat/data_stream/log/fields/base-fields.yml b/packages/tomcat/data_stream/log/fields/base-fields.yml
index 423a2e20de9..9ea6d274acc 100644
--- a/packages/tomcat/data_stream/log/fields/base-fields.yml
+++ b/packages/tomcat/data_stream/log/fields/base-fields.yml
@@ -7,9 +7,6 @@
 - name: data_stream.namespace
   type: constant_keyword
   description: Data stream namespace.
-- name: '@timestamp'
-  type: date
-  description: Event timestamp.
 - name: event.module
   type: constant_keyword
   description: Event module
diff --git a/packages/tomcat/data_stream/log/fields/ecs.yml b/packages/tomcat/data_stream/log/fields/ecs.yml
index 31bb5a5f2cf..b9bbc724f76 100644
--- a/packages/tomcat/data_stream/log/fields/ecs.yml
+++ b/packages/tomcat/data_stream/log/fields/ecs.yml
@@ -208,8 +208,6 @@
   name: source.top_level_domain
 - external: ecs
   name: tags
-- external: ecs
-  name: tags
 - external: ecs
   name: url.domain
 - external: ecs
diff --git a/packages/tomcat/docs/README.md b/packages/tomcat/docs/README.md
index 6d745dce6be..2cf0e0de88c 100644
--- a/packages/tomcat/docs/README.md
+++ b/packages/tomcat/docs/README.md
@@ -13,7 +13,7 @@ The `log` dataset collects Apache Tomcat logs.
 
 | Field | Description | Type |
 |---|---|---|
-| @timestamp | Event timestamp. | date |
+| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date |
 | client.domain | The domain name of the client system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword |
 | client.registered_domain | The highest registered client domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword |
 | client.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword |
diff --git a/packages/tomcat/manifest.yml b/packages/tomcat/manifest.yml
index 8e17c786316..b81aba3ac57 100644
--- a/packages/tomcat/manifest.yml
+++ b/packages/tomcat/manifest.yml
@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: tomcat
 title: Apache Tomcat
-version: "1.7.0"
+version: "1.7.1"
 description: Collect and parse logs from Apache Tomcat servers with Elastic Agent.
 categories: ["web", "security"]
 release: ga