elastic / elastic/ecs

http.response.status_code as long instead of keyword or integer

Open
#564 19 comments 0 reactions 0 assignees View on GitHub
discuss
Dominant language
Python
Stars
1.1k
Forks
455
Avg merge
17h 8m
Merged PRs (30d)
5

Description

Hello ,
I did not found any discussion on this topic so , I ask the question
In ECS the `http.response.status_code` is mapped as long , why ?

Using an integer brings the advantage of taking up less space, but we are not supposed to do digital operations (sum/avg...) on an HTTP status because all codes are between 100 and 599.

Using a keyword will allow to run an aggregation without specifying a null_value.
The keyword type will also allow to make range query if necessary (it will be in alphanumeric order):
[ECS source code](https://github.com/elastic/ecs/blob/master/schemas/http.yml#L36)
```
- name: response.status_code
format: string
level: extended
type: long
description: >
HTTP response status code.
example: 404
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.