# Geo fields at root?
**URL:** https://discuss.elastic.co/t/geo-fields-at-root/341307
**Category:** Elasticsearch
**Tags:** ecs-elastic-common-schema
**Created:** [August 21, 2023, 11:41pm UTC](https://discuss.elastic.co/t/geo-fields-at-root/341307 "2023-08-21T23:41:00Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@rsk0](https://discuss.elastic.co/u/rsk0)
#### Post date: [August 21, 2023, 11:41pm UTC](https://discuss.elastic.co/t/geo-fields-at-root/341307/1 "2023-08-21T23:41:00Z")
[ECS `geo` docs](https://www.elastic.co/guide/en/ecs/current/ecs-geo.html) say:
> The geo fields are expected to be nested at:
>
> ```
> client.geo
> destination.geo
> host.geo
> server.geo
> ...
>
> ```
>
> Note also that the `geo` fields are not expected to be used directly **at the root** of the events.
I was thinking we might want to maintain orthogonality between events and any particular event aspect. That is, we should be able to just say an event happened at some `geo`.
This is a little theoretical, but should we not be able to log event location regardless of whether there was a client or server or even host involved?
🤔 I suppose it's reasonable to think of ECS as only addressing _software_ events. That's the implied domain we're working in. I have to assume that ECS is not meant for recording things like earthquakes or police activity or news events.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 22, 2023, 12:58am UTC](https://discuss.elastic.co/t/geo-fields-at-root/341307/2 "2023-08-22T00:58:17Z")
Not just SW, HW, IOT etc but yes mostly technology events.
For pure non technology events like news earthquake etc... ECS is not really contemplative of those domains.
You could use
`source.geo`
Or create your own geo the suggestion to not put it at the root is just a suggestion because there can be more than one geo.
You can add fields to your events. As long as they don't collide with ECS, you should be fine.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 19, 2023, 12:59am UTC](https://discuss.elastic.co/t/geo-fields-at-root/341307/3 "2023-09-19T00:59:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.