ECS for syslog: why Filebeat does not follow ECS naming convention

Elastic Stack Logstash
1

we're indexing syslogs data via Logstash (without Filebeat).
Since it's not that clear, how Logstash manages ECS schema, I checked the Filebeat mapping and realized, that it uses different naming for Syslog: system.syslog.*
ECS syslog fields starts from: log.syslog.*

Questions:

  1. what is the correct mapping (ECS or Filebeat docu)?
  2. can Logstash remap the standard syslog fields to ECS ones
    (e.g. timereported -> @timestamp, syslogseverity-text -> log.syslog.severity.name) or do we need to "re-invent the wheel"?

Thanks a lot!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.