elastic / elastic/ecs

ECS Ingest processor

Open
#181 13 comments 4 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
1.1k
Forks
455
Avg merge
17h 8m
Merged PRs (30d)
5

Description

With ECS we know the exact structure of some fields. Based on this some common processing happens. A few examples:

`source.ip` -> geoip processor to enrich with geo information
`user_agent.original` -> user_agent enrichement

Since Elasticsearch 6.5 it is possible to have a pipeline that calls an other pipeline: https://www.elastic.co/guide/en/elasticsearch/reference/6.5/pipeline-processor.html We could provide an ECS pipeline that does all this default processing. All that users would have to do is adding it to their ingest pipeline.

Over time we could add more processing in such a pipeline. For example if we have a convention that all `http.request.method` should be upper case the Uppercase Processor could be applied to this field and similar things.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.