# ECS - Difference between event.id and event.code **URL:** \ **Category:** Elasticsearch\ **Tags:** ecs-elastic-common-schema\ **Created:** [March 17, 2022, 8:53am UTC](https://discuss.elastic.co/t/ecs-difference-between-event-id-and-event-code/299924 "2022-03-17T08:53:57Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Sako](https://avatars.discourse-cdn.com/v4/letter/s/e9bcb4/32.png) [@Sako](https://discuss.elastic.co/u/Sako)\ **Post date:** [March 17, 2022, 8:53am UTC](https://discuss.elastic.co/t/ecs-difference-between-event-id-and-event-code/299924/1 "2022-03-17T08:53:57Z")
Hi, I have a question regarding the usage of the ECS fields event.id and event.code. What is the intended difference between these two fields? Is there any guidance on how to use them? The example for event.code references the Windows Event ID - which to me might be better put into event.id then? Greetings! ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [March 17, 2022, 6:38pm UTC](https://discuss.elastic.co/t/ecs-difference-between-event-id-and-event-code/299924/2 "2022-03-17T18:38:04Z")
This is my understanding of them. `event.id` should be unique to the event instance (like the record ID in windows events). `event.code` is identifier that indicates the type of event or message. Like if a log has a error code that you can lookup to learn more info then you could put that into `event.code`. ---
**Author:** ![Sako](https://avatars.discourse-cdn.com/v4/letter/s/e9bcb4/32.png) [@Sako](https://discuss.elastic.co/u/Sako)\ **Post date:** [March 21, 2022, 2:20pm UTC](https://discuss.elastic.co/t/ecs-difference-between-event-id-and-event-code/299924/3 "2022-03-21T14:20:59Z")
So you say that the windows event id should go into `event.id`. The documentation says otherwise and references `event.code` for this. Is there a more practical example with an event that maybe uses both fields? ---
**Author:** ![ebeahan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ebeahan/32/78989_2.png) [@ebeahan](https://discuss.elastic.co/u/ebeahan)\ **Post date:** [March 24, 2022, 2:37pm UTC](https://discuss.elastic.co/t/ecs-difference-between-event-id-and-event-code/299924/4 "2022-03-24T14:37:38Z")
In Windows events, there's both a [record ID](https://docs.microsoft.com/en-us/windows/win32/wes/eventschema-eventrecordid-systempropertiestype-element) and [Event ID](https://docs.microsoft.com/en-us/windows/win32/wes/eventschema-eventid-systempropertiestype-element). Record ID is a unique number of the event in the event log, and Event ID describes the type of event, like 4624, 4625, etc. Another example for `event.code` is [MySQL error messages](https://dev.mysql.com/doc/mysql-errors/8.0/en/server-error-reference.html) which have an assigned reference code for each error type. ---
**Author:** ![Sako](https://avatars.discourse-cdn.com/v4/letter/s/e9bcb4/32.png) [@Sako](https://discuss.elastic.co/u/Sako)\ **Post date:** [March 24, 2022, 3:24pm UTC](https://discuss.elastic.co/t/ecs-difference-between-event-id-and-event-code/299924/5 "2022-03-24T15:24:35Z")
Ok, I think I got it now. Thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 21, 2022, 3:24pm UTC](https://discuss.elastic.co/t/ecs-difference-between-event-id-and-event-code/299924/6 "2022-04-21T15:24:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.