# ECS in avro format

**URL:** <https://discuss.elastic.co/t/ecs-in-avro-format/272170>\
**Category:** Logs\
**Tags:** ecs-elastic-common-schema\
**Created:** [May 5, 2021, 10:46am UTC](https://discuss.elastic.co/t/ecs-in-avro-format/272170 "2021-05-05T10:46:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![birko](https://avatars.discourse-cdn.com/v4/letter/b/dbc845/32.png) [@birko](https://discuss.elastic.co/u/birko)\
**Post date:** [May 5, 2021, 10:46am UTC](https://discuss.elastic.co/t/ecs-in-avro-format/272170/1 "2021-05-05T10:46:54Z")

</div>

I'm looking for avro schema representation of ecs. It is necessary in Apache NiFi, when you're trying to transform data with record-oriented processors. Workaround is to use InferAvroSchema processor, but there is necessary some json file with all ecs fields. [ECS tooling](https://github.com/elastic/ecs/blob/master/USAGE.md) doesn't provide this

So, is it available somewhere one of these two options, please?

1. avro schema representation of ecs
2. example json file with all ecs fields according to ecs version

Thanks a lot

---

<div class="post-metadata">

**Author:** ![ebeahan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ebeahan/32/78989_2.png) [@ebeahan](https://discuss.elastic.co/u/ebeahan)\
**Post date:** [May 5, 2021, 3:45pm UTC](https://discuss.elastic.co/t/ecs-in-avro-format/272170/2 "2021-05-05T15:45:19Z")

</div>

Hi, @birko!

There are two YAML files that are a full representation of ECS maintained in [the ECS repo](https://github.com/elastic/ecs/tree/v1.9.0/generated/ecs). You can view whatever version(s) you need by switching the branch/tag.

These files can be [converted](https://gist.github.com/ebeahan/b321f06b8b4e114a9d19e518b9961f7f#file-ecs_nested-json) to JSON and might be a good starting place for what you need here.

---

<div class="post-metadata">

**Author:** ![birko](https://avatars.discourse-cdn.com/v4/letter/b/dbc845/32.png) [@birko](https://discuss.elastic.co/u/birko)\
**Post date:** [May 6, 2021, 2:22pm UTC](https://discuss.elastic.co/t/ecs-in-avro-format/272170/3 "2021-05-06T14:22:47Z")

</div>

Hi @ebeahan,  
I did this, maybe it will be helpful for someone:

1. csv with columns Field,Type,Example from fields.csv (generated by ECS tooling)
2. some corrections of this csv (many examples were missing)
3. csv-\>json conversion via [CSV To JSON Converter](https://www.convertcsv.com/csv-to-json.htm)
4. InferAvroSchema created avro schema according to json

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 3, 2021, 2:23pm UTC](https://discuss.elastic.co/t/ecs-in-avro-format/272170/4 "2021-06-03T14:23:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.