elastic/ecs

View on GitHub

Stars: 1.1k
Forks: 455
Open beginner issues: 0
Indexed issues: 206
Avg merge: 17h 8m
Merged PRs (30d): 5

Dominant language: Python
License: Apache-2.0
Last GitHub push: Aug 19, 2026
Latest indexed: Sep 15, 2026
Contributing guide: Contributing guide
Code of conduct: No code of conduct
Beginner labels: good first issue

Open All

206 open issues indexed

New use case: DHCP Open

New Field Request RFC:candidate

elastic/ecs#61 · 10 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
host.name vs hostname, host.ip vs ip inconsistencies Open

discuss

elastic/ecs#62 · 9 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Guidance on anonymization/pseudonymization Open

discuss

elastic/ecs#68 · 26 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Missing host fields Open

discuss New Field Request

elastic/ecs#75 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Add network.address Open

discuss New Field Request

elastic/ecs#86 · 24 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Application Fields (e.g. app name for Endpoint Detection logs)? Open

discuss New Field Request RFC:candidate

elastic/ecs#126 · 13 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Using ECS to track the source of errors or exceptions Open

discuss

elastic/ecs#154 · 21 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
ECS Ingest processor Open

enhancement

elastic/ecs#181 · 13 comments · 4 reactions · 0 assignees · Indexed Sep 15, 2026
Introduce event.flags Open

discuss New Field Request

elastic/ecs#191 · 3 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Please explain difference between Core and Extended Open

question

elastic/ecs#219 · 7 comments · 0 reactions · 1 assignee · Indexed Sep 15, 2026
Question: HTTP Headers Open

question RFC:candidate

elastic/ecs#232 · 14 comments · 6 reactions · 0 assignees · Indexed Sep 15, 2026
Apply lowercase normalizer to certain keyword fields in template Open

enhancement

elastic/ecs#260 · 4 comments · 4 reactions · 0 assignees · Indexed Sep 15, 2026
Add new top level field "environment" Open

discuss New Field Request RFC

elastic/ecs#268 · 9 comments · 7 reactions · 0 assignees · Indexed Sep 15, 2026
Increase ignore_above for a few fields that can clearly contain longer legit values Open

discuss enhancement

elastic/ecs#270 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Improvements / Clarifications to process.* fields Open

discuss

elastic/ecs#278 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Populating of source/destination if both source/client or server/destination is being used Open

discuss

elastic/ecs#300 · 8 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Field for service status Open

discuss New Field Request

elastic/ecs#303 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
New field request: cloud.instance.lifecycle Open

discuss New Field Request

elastic/ecs#323 · 4 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
ECS fieldset for Varnish access logs; time_firstbyte Open

enhancement

elastic/ecs#387 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Missing host parents field Open

discuss enhancement

elastic/ecs#409 · 3 comments · 2 reactions · 0 assignees · Indexed Sep 15, 2026
File Names - Source/Destination/Client/Server Open

elastic/ecs#413 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Software - Source/Destination and/or Client/Server Open

elastic/ecs#416 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Network 4 Tuple Open

elastic/ecs#417 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
request for a new transport field in source / client / server Open

elastic/ecs#418 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
clarification of layer to which bytes refer in source / destination / client / server / network Open

elastic/ecs#419 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
ECS dashboard ideas Open

discuss

elastic/ecs#423 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Introduce `timeseries.instance` to ECS Open

discuss enhancement use case

elastic/ecs#431 · 3 comments · 2 reactions · 0 assignees · Indexed Sep 15, 2026
File System Open

enhancement

elastic/ecs#440 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Introduce a "volume" field set Open

elastic/ecs#444 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Documentation: list of all available fields. Open

elastic/ecs#446 · 4 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Field event.type should not be reserved Open

elastic/ecs#447 · 5 comments · 2 reactions · 0 assignees · Indexed Sep 15, 2026
Missing schema for device Open

elastic/ecs#448 · 8 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
YAML validation Open

ready

elastic/ecs#463 · 7 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Schema for metrics Open

discuss RFC:candidate

elastic/ecs#474 · 21 comments · 3 reactions · 0 assignees · Indexed Sep 15, 2026
Event.duration is often inappropriate, missing http request+response+ ... durations Open

elastic/ecs#476 · 2 comments · 4 reactions · 0 assignees · Indexed Sep 15, 2026
New field: user.account.id Open

elastic/ecs#478 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
event.original in splitted events Open

elastic/ecs#479 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
User.hash vs. new hash.* fields Open

ready

elastic/ecs#483 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Missing destination host Open

elastic/ecs#500 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
`services` in organizational hierarchy Open

elastic/ecs#508 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
IIS `sub_status_code` and `win32_status` mapping Open

elastic/ecs#509 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
New field log.verbosity Open

elastic/ecs#513 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
forwarded_ip - no place to put geo ... fields Open

discuss

elastic/ecs#523 · 3 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Plan to handle all the beats winlog event_data fields Open

elastic/ecs#536 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
host.infrastructure Open

elastic/ecs#539 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
ECS Safety template for field types needed, so different versions can be supported Open

elastic/ecs#548 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Mapping application deployment / build information Open

elastic/ecs#560 · 4 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
http.response.status_code as long instead of keyword or integer Open

discuss

elastic/ecs#564 · 19 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Operating System field for Linux, Windows, macOS Open

ready RFC:candidate

elastic/ecs#576 · 6 comments · 2 reactions · 0 assignees · Indexed Sep 15, 2026
Number of bytes since last log vs. total Open

elastic/ecs#580 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026

elastic/ecs

Get new issues in your inbox