pub const SOURCE_ADDRESS: &str = "source.address";Expand description
Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field.
Then it should be duplicated to .ip or .domain, depending on which one it is.