How to setting ECS（Elastic Common Schema） true in Elasticsearch 6.7

Elastic Stack Elasticsearch
1

Hi !

When I did the following, a warning occurred.

In Elasticsearch 6.7, is there a way to configure using ECS ​​(Elastic Common Schema)?
Is it impossible to wait until Elasticsearch 7.0?

◆POST

POST _ingest/pipeline/_simulate
{
  "pipeline": {
  "description" : "parse multiple patterns",
  "processors": [
    {
      "user_agent": {
        "field": "agent"
      }
    }
  ]
},
"docs":[
  {
    "_source": {
      "agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
    }
  }
  ]
}

◆Warning

#! Deprecation: setting [ecs] to false for non-common schema format is deprecated and will be removed in 8.0, set to true to use the non-deprecated format
2

You can do:

POST _ingest/pipeline/_simulate
{
  "pipeline": {
  "description" : "parse multiple patterns",
  "processors": [
    {
      "user_agent": {
        "field": "agent",
        "ecs": true
      }
    }
  ]
},
"docs":[
  {
    "_source": {
      "agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
    }
  }
  ]
}
1 Like
3

Thanks!! I wanted to know this.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.