# ECS - Exported fields origin of rsa.foo.\*
**URL:** https://discuss.elastic.co/t/ecs-exported-fields-origin-of-rsa-foo/285554
**Category:** Beats
**Tags:** filebeat, winlogbeat
**Created:** [September 30, 2021, 8:31am UTC](https://discuss.elastic.co/t/ecs-exported-fields-origin-of-rsa-foo/285554 "2021-09-30T08:31:24Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@CamTheMan](https://discuss.elastic.co/u/CamTheMan)
#### Post date: [September 30, 2021, 8:31am UTC](https://discuss.elastic.co/t/ecs-exported-fields-origin-of-rsa-foo/285554/1 "2021-09-30T08:31:24Z")
I'm currently implementing 'ECS' for our in house products and I was wondering what the origin or meaning of the 'rsa' fields are?
It is unusual in that they span multiple vendors and am wondering what the 'rsa' acronym stands for.
Examples:
**`rsa.internal.msg_id`** from [cisco fields](https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-cisco.html) and [juniper fields](https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-juniper.html)
What does the 'rsa' acronym stand for?
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [September 30, 2021, 10:56am UTC](https://discuss.elastic.co/t/ecs-exported-fields-origin-of-rsa-foo/285554/2 "2021-09-30T10:56:00Z")
It comes from [GitHub - blookot/rsa2elk: Converts Netwitness log parser configuration to Logstash configuration](https://github.com/blookot/rsa2elk) and was used as an easy way to create some of the modules. It will go away in the future as the Agent integrations are built out.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 28, 2021, 12:56pm UTC](https://discuss.elastic.co/t/ecs-exported-fields-origin-of-rsa-foo/285554/3 "2021-10-28T12:56:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.