Convert fields to ECS

Elastic Stack Logstash
4

I mean that you should use

rename => {
    "EventType" => "[dns][type]"
    "ResponseCode" => "[dns][response_code]"
    "InternalIp" => "[source][ip]"
    ...
}

If you have a "dns" object that contains a type field then in elasticsearch that would be called dns.type. In logstash it is referred to as [dns][type]