I'm working on setting up my custom sources to be more in line with ECS. In my filebeat configurations I had been adding the fields
environment (ex devl,qual,cert,prod)
Reading the ECS doc, I think the first three belong under the "host" top level.
The last one I was using to track whether a message was processed through an ingest node (pipeline) or logstash.
I'm trying to figure out how this field would be better represented in ECS. Ideally, I want to record
Processed by logstash and which pipeline
Processed by ingest node and which pipeline
Does anyone have suggestions on how this should be represented? Or I could just use tags?