ECS
Elastic Common Schema (ECS) is a specification that defines a common set of fields for ingesting data into Elasticsearch.
DataStream uses ECS in two distinct ways, and they differ in whether a version applies.
The flow collectors — the netflow, ipfix, and sflow devices — emit ECS-shaped JSON records conforming to ECS 8.11.0, and write that value into the ecs.version field of every record.
The Normalize processor uses ECS differently: as the pivot schema for all conversions. It converts the source format to ECS first, then from ECS to the requested target format, so converting between any two supported formats passes through the ECS field names below. This internal representation is not pinned to an ECS release and carries no ecs.version field.
Field groups include:
| Field Group | Core Fields | Description |
|---|---|---|
| Base Fields | @timestamp, tags, labels, message | Universal fields that appear in every event |
| Host | host.name, host.ip, host.os.*, host.mac | Information about the host machine |
| Network | network.protocol, network.type, network.direction, network.bytes | Network activity details |
| Source/Destination | source.ip, source.port, destination.ip, destination.port | Communication endpoint information |
| User | user.id, user.name, user.domain, user.email | User-related information |
| Event | event.category, event.type, event.action, event.outcome | Event classification details |
| File | file.path, file.size, file.type, file.hash.* | File-related information |
| Process | process.pid, process.name, process.args, process.parent.* | Process execution details |
| Error | error.message, error.type, error.stack_trace | Error-related information |