Move delivery_timestamp to doc level

Update command event_generator

Remove delivery_timestamp from custom command fields

ecs/command/event-generator/event_generator.py

@@ -54,6 +54,7 @@ def generate_random_command(include_all_fields=False):
 
     if include_all_fields:
         document["@timestamp"] = generate_random_date()
+        document["delivery_timestamp"] = generate_random_date(parse_date(document["@timestamp"]))
         document["agent"]["groups"] = [f"group{random.randint(1, 5)}"],
         document["command"]["status"] = random.choice(
             ["pending", "sent", "success", "failure"])
@@ -65,7 +66,6 @@ def generate_random_command(include_all_fields=False):
         # Generate UUIDs for request_id and order_id
         document["command"]["request_id"] = str(uuid.uuid4())
         document["command"]["order_id"] = str(uuid.uuid4())
-        document["command"]["delivery_timestamp"] = generate_random_date(parse_date(document["@timestamp"]))
 
     return document
 

ecs/command/fields/custom/command.yml

@@ -77,8 +77,3 @@
       level: custom
       description: >
         UUID generated by the Command Manager.
-    - name: delivery_timestamp
-      type: date
-      level: custom
-      description: >
-        The latest date-time for the command to be delivered. Calculated as the current timestamp plus the timeout.

ecs/command/fields/subset.yml

@@ -10,3 +10,8 @@ fields:
       groups: {}
   command:
     fields: "*"
+  delivery_timestamp:
+    type: date
+    level: custom
+    description: >
+      The latest date-time for the command to be delivered. Calculated as the current timestamp plus the timeout.