Module document 

Building the document that actually goes to Elasticsearch.

Field names here are not ours to choose: they are the beta index’s mapping (V2-1016), and a mismatch means a field lands as dynamically-mapped text instead of the keyword the dashboards aggregate on. Two in particular read wrong at a glance and are right:

• the time field is @timestamp, not timestamp;
• the node’s build is binary_version, while version and commit carry whatever ant-node said about itself on its startup line. Keeping them separate avoids two half-populated fields meaning the same thing with no rule for which wins.

Two mapped fields are deliberately never sent. host is stripped by the ingest pipeline — machine hostnames routinely contain someone’s name — and beta_user is stamped server-side from the authenticated API key, so anything we sent would be discarded and replaced anyway.

Structs

DocumentSource

The _source body of a forwarded document.

ForwardDocument

A document ready to be framed into a bulk request.

NodeTags

The identity fields every event from a given node carries.