geo docs say:
The geo fields are expected to be nested at:
client.geo destination.geo host.geo server.geo ...
Note also that the
geofields are not expected to be used directly at the root of the events.
I was thinking we might want to maintain orthogonality between events and any particular event aspect. That is, we should be able to just say an event happened at some
This is a little theoretical, but should we not be able to log event location regardless of whether there was a client or server or even host involved?
I suppose it's reasonable to think of ECS as only addressing software events. That's the implied domain we're working in. I have to assume that ECS is not meant for recording things like earthquakes or police activity or news events.