# Grok ecs\_compatibility option

**URL:** <https://discuss.elastic.co/t/grok-ecs-compatibility-option/375702>\
**Category:** Logstash\
**Created:** [March 11, 2025, 12:04pm UTC](https://discuss.elastic.co/t/grok-ecs-compatibility-option/375702 "2025-03-11T12:04:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![frans-wtax](https://avatars.discourse-cdn.com/v4/letter/f/ce73a5/32.png) [@frans-wtax](https://discuss.elastic.co/u/frans-wtax)\
**Post date:** [March 11, 2025, 12:04pm UTC](https://discuss.elastic.co/t/grok-ecs-compatibility-option/375702/1 "2025-03-11T12:04:32Z")

</div>

Hey all,

I noticed that my grok filter that uses the COMBINEDAPACHELOG pattern ([logstash-patterns-core/patterns/ecs-v1/httpd at main · logstash-plugins/logstash-patterns-core · GitHub](https://github.com/logstash-plugins/logstash-patterns-core/blob/main/patterns/ecs-v1/httpd)) doesn't actually return the `[user][name]` and `[apache][access][user][identity]` fields even though they're in the pattern.

Under the `ecs_compatibility` option on the `grok` documentation page there's a statement that I don't understand that maybe explains this?

> Controls this plugin’s compatibility with the [Elastic Common Schema (ECS)](https://www.elastic.co/guide/en/ecs/8.17). The value of this setting affects extracted event field names when a composite pattern (such as `HTTPD_COMMONLOG`) is matched.

Can somebody clarify what "The value of this setting affects extracted event field names when a composite pattern is matched" means? Does this explain why the `[user][name]` and `[apache][access][user][identity]` fields are missing?

Thanks,  
Frans

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 11, 2025, 12:40pm UTC](https://discuss.elastic.co/t/grok-ecs-compatibility-option/375702/2 "2025-03-11T12:40:07Z")

</div>

The ecs\_compatibility option determines whether it uses [this](https://github.com/logstash-plugins/logstash-patterns-core/blob/main/patterns/ecs-v1/httpd) set of patterns, or [this](https://github.com/logstash-plugins/logstash-patterns-core/blob/main/patterns/legacy/httpd) one.

The part about composite patterns is, strictly speaking, true, but it doesn't really add any value to the sentence. The settings affects the field names.

---

<div class="post-metadata">

**Author:** ![frans-wtax](https://avatars.discourse-cdn.com/v4/letter/f/ce73a5/32.png) [@frans-wtax](https://discuss.elastic.co/u/frans-wtax)\
**Post date:** [March 11, 2025, 12:44pm UTC](https://discuss.elastic.co/t/grok-ecs-compatibility-option/375702/3 "2025-03-11T12:44:56Z")

</div>

Thanks @Badger !

I now see the patterns for each part of the log line are `(?:-|%{PATTERN:variable})` which I guess means that if the value in the log line is a literal `-` then the second part of that expression isn't applied and hence `variable` isn't set. I guess that explains why I'm not getting the variable in the output. Then I just need to figure out why nginx (which is creating the logs in my case) is printing `-` instead of the actual username.