elastic / elastic/ecs

Please explain difference between Core and Extended

Open
#219 7 comments 0 reactions 1 assignee Claimed by @MikePaquette View on GitHub
question
Dominant language
Python
Stars
1.1k
Forks
455
Avg merge
17h 8m
Merged PRs (30d)
5

Description

What is the difference between “core” and “extended” levels? (A definition for each type would be helpful here.) Is “core” required? Do you generate an error when core fields are missing?

No. 2 of 16. This question was asked by a new ECS user, who is familiar with mapping IT events to data models and use cases in other schemas. These questions are being posted as a GitHub issue, because a) they may offer valuable insights. b) we expect that many new users will have similar questions.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.