# Does elastic support transfer old data to ecs format?

**URL:** <https://discuss.elastic.co/t/does-elastic-support-transfer-old-data-to-ecs-format/321378>\
**Category:** Elasticsearch\
**Created:** [December 16, 2022, 7:06am UTC](https://discuss.elastic.co/t/does-elastic-support-transfer-old-data-to-ecs-format/321378 "2022-12-16T07:06:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex\_su](https://avatars.discourse-cdn.com/v4/letter/a/d6d6ee/32.png) [@alex\_su](https://discuss.elastic.co/u/alex_su)\
**Post date:** [December 16, 2022, 7:06am UTC](https://discuss.elastic.co/t/does-elastic-support-transfer-old-data-to-ecs-format/321378/1 "2022-12-16T07:06:30Z")

</div>

Hi, I want to know if i have old data (ex: windows event log) as below , does elasitc has package support transfer this format to ecs ?

thanks.

```auto
"{
  ""configSource"": ""XXX"",
  ""_User"": """",
  ""@version"": ""1"",
  ""__data_source"": ""XXXX"",
  ""hostId"": ""XX-a-ada-asdas-dasda"",
  ""_EventType"": 5,
  ""_SourceName"": ""Microsoft-Windows-Security-Auditing"",
  ""LoghostIp"": ""XXXX.XXX,
  ""_EventClass"": ""Win32_NTLogEvent"",
  ""_Type"": """",
  ""_EventIdentifier"": 4625,
  ""_TimeWritten"": ""20221104073401.507809-000"",
  ""configId"": ""id-hmd"",
  ""_Logfile"": ""Security"",
  ""_Category"": 12544,
  ""@timestamp"": ""2022-11-04T07:34:08.563Z"",
  ""__data_type"": ""log"",
  ""_ComputerName"": ""IMC-DSS-tAP02"",
  ""__has_error"": ""false"",
  ""_CategoryString"": ""logon"",
  ""__index_name"": """,
  ""_RecordNumber"": 255545182,
  ""_eventDttm_"": ""2022-11-04T07:34:08.563Z"",
  ""_TimeGenerated"": ""20221104073401.507809-000"",
  ""_InsertionStrings"": ""S-1-5-18XXXXX$WORKGROUP0x3e7S-1-0-xXXX-DSS-AP010xc000006e%%23090xc00000714Advapi NegotiateIMC-DSS-TAP02--00x4f8C:\\Windows\\System32\\svchost.exe-"",
  ""_host"": ""XX.XX.XX.XX"",
  ""_EventCode"": 4625,
  ""message"": """",
  ""__insertTime"": ""2022-11-04T07:34:08.563Z""
}"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 13, 2023, 7:07am UTC](https://discuss.elastic.co/t/does-elastic-support-transfer-old-data-to-ecs-format/321378/2 "2023-01-13T07:07:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.