Add interface fields at inventory-networks root level

ecs/docs/inventory-networks.md

@@ -51,34 +51,27 @@ fields:
       "@timestamp": {}
   agent:
     fields:
-      id: {}
       groups: {}
-  destination:
-    fields:
-      ip: {}
-      port: {}
-  device:
-    fields:
       id: {}
-  file:
-    fields:
-      inode: {}
+      name: {}
+      type: {}
+      version: {}
+      host:
+        fields: "*"
   host:
+    fields: "*"
+  interface:
     fields:
-      ip: {}
-      mac: {}
-      network:
-        fields:
-          egress:
-            fields:
-              bytes: {}
-              packets: {}
-          ingress:
-            fields:
-              bytes: {}
-              packets: {}
+      mtu: {}
+      state: {}
+      type: {}
   network:
     fields:
+      broadcast: {}
+      dhcp: {}
+      gateway: {}
+      metric: {}
+      netmask: {}
       protocol: {}
       type: {}
   observer:
@@ -89,14 +82,7 @@ fields:
             fields:
               alias: {}
               name: {}
-  process:
-    fields:
-      name: {}
-      pid: {}
-  source:
-    fields:
-      ip: {}
-      port: {}
+
 ```
 
 ### Index settings

ecs/states-inventory-networks/event-generator/event_generator.py

@@ -138,14 +138,17 @@ def generate_random_network():
     }
     return network
 
+def generate_random_interface():
+    interface = {
+        'alias': f'alias{random.randint(0, 9999)}',
+        'name': f'name{random.randint(0, 9999)}'
+    }
+    return interface
 
 def generate_random_observer():
     observer = {
         'ingress': {
-            'interface': {
-                'alias': f'alias{random.randint(0, 9999)}',
-                'name': f'name{random.randint(0, 9999)}'
-            }
+            'interface': generate_random_interface()
         }
     }
     return observer
@@ -159,7 +162,8 @@ def generate_random_data(number):
             'agent': generate_random_agent(),
             'host': generate_random_host(),
             'network': generate_random_network(),
-            'observer': generate_random_observer()
+            'observer': generate_random_observer(),
+            'interface': generate_random_interface()
         }
         data.append(event_data)
     return data

ecs/states-inventory-networks/fields/custom/interface.yml

@@ -1,5 +1,9 @@
 ---
 - name: interface
+  reusable:
+    top_level: true
+    expected:
+      - { at: observer.egress.interface, as: observer.ingress.interface }
   title: Interface
   type: group
   group: 2