# How Elastic common schema names are define for the log fields

**URL:** <https://discuss.elastic.co/t/how-elastic-common-schema-names-are-define-for-the-log-fields/186725>\
**Category:** Elasticsearch\
**Tags:** ecs-elastic-common-schema\
**Created:** [June 20, 2019, 3:51pm UTC](https://discuss.elastic.co/t/how-elastic-common-schema-names-are-define-for-the-log-fields/186725 "2019-06-20T15:51:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mani2451](https://avatars.discourse-cdn.com/v4/letter/m/dfb087/32.png) [@Mani2451](https://discuss.elastic.co/u/Mani2451)\
**Post date:** [June 20, 2019, 3:51pm UTC](https://discuss.elastic.co/t/how-elastic-common-schema-names-are-define-for-the-log-fields/186725/1 "2019-06-20T15:51:40Z")

</div>

Hi Elastic Team,

I have certain fields which we use in Linux logs and can you please let me know what would be the Elastic common schema(ECS) name for those fields and how you define the ECS name for those fields ??

**Fields** : timestamp, ppid, msg, address, hostname, terminal, algo, comm, success, server etc

**Example** : we had **src\_ip** defined in one of our logs and elastic common schema accepts source.ip how this is defined ?

> **[Elastic Common Schema (ECS): The Common Event Model for Elasticsearch](https://www.elastic.co/blog/introducing-the-elastic-common-schema)**
>
> Introducing the Elastic Common Schema (ECS), a new specification that provides a consistent and customizable way to structure your data in Elasticsearch, helping machine learning jobs be applied more broadly, searches be crafted more narrowly, and...

  
please look into the section **Example 2: Search** from the above link where you can find the details of **src\_ip** example which I mentioned about!

---

<div class="post-metadata">

**Author:** ![webmat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/webmat/32/46191_2.png) [@webmat](https://discuss.elastic.co/u/webmat)\
**Post date:** [June 20, 2019, 6:55pm UTC](https://discuss.elastic.co/t/how-elastic-common-schema-names-are-define-for-the-log-fields/186725/2 "2019-06-20T18:55:47Z")

</div>

Hey @Mani2451, thanks for dropping by. All of the ECS fields are documented extensively in our documentation here: [https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html)

Most of the fields you mention here you'll find right away, either in the Base fields, or under the field sets event, process, host.

Some of the fields you mention aren't obvious in what they mean. So it depends on what's in there. If after looking at the docs, you're not sure where to map some of them, please ping me again here.

Final note, if ECS really doesn't cover a few of your fields, you're free to add them as custom fields. ECS is an inclusive schema. You map to ECS what you can, and you add your additional fields under a custom field set, e.g. `myapp.algo`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 18, 2019, 6:56pm UTC](https://discuss.elastic.co/t/how-elastic-common-schema-names-are-define-for-the-log-fields/186725/3 "2019-07-18T18:56:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.