# Need Some Advice Regarding Data Ingestion **URL:** \ **Category:** Elasticsearch\ **Tags:** ecs-elastic-common-schema\ **Created:** [March 16, 2022, 12:47pm UTC](https://discuss.elastic.co/t/need-some-advice-regarding-data-ingestion/299859 "2022-03-16T12:47:43Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![tthiry](https://avatars.discourse-cdn.com/v4/letter/t/a4c791/32.png) [@tthiry](https://discuss.elastic.co/u/tthiry)\ **Post date:** [March 16, 2022, 12:47pm UTC](https://discuss.elastic.co/t/need-some-advice-regarding-data-ingestion/299859/1 "2022-03-16T12:47:43Z")
Hello, I am ingesting Windows certificate data via winlogbeat and the "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational" channel to I can track certificates that are expiring. I am using the "include\_xml" switch and the "decode\_xml" processor in my winlogbeat configuration. That all seems to be working fine. The fields that get parsed look like this: "event.userdata.certnotificationdata.action" "event.userdata.certnotificationdata.accountname" "event.userdata.certnotificationdata.certificatedetails.notvalidafter" "event.userdata.certnotificationdata.certificatedetails.subjectnames.subjectname" As you can see they are quite long. I'd like to map them to ECS fields but I noticed that there are TLS fields and x.509 fields and I am confused as to which one I should use. Also I want to ensure that the "event.userdata.certnotificationdata.certificatedetails.notvalidafter" is a date or timestamp field so that I can do date math on it to report on expiring certificates. Does it matter which set of field sets I use? Can I mix them? Can/should I add field that don't exist in the ECS? for example If I want to keep a record of the user who deleted a certificate, can I rename "event.userdata.certnotificationdata.accountname" to "tls.client.accountname"? Or, should I make my own fields e.g. cert.XXXX so that I'm not confusing the fact that the certificate information was not gathered view network traffic ingestion, which seems to be the use case for the TLS and x.509 fields? Thanks, Tony ---
**Author:** ![ebeahan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ebeahan/32/78989_2.png) [@ebeahan](https://discuss.elastic.co/u/ebeahan)\ **Post date:** [March 24, 2022, 2:58pm UTC](https://discuss.elastic.co/t/need-some-advice-regarding-data-ingestion/299859/2 "2022-03-24T14:58:19Z")
Hello, @tthiry! > [@](#): > > Does it matter which set of field sets I use? Are these logs related to Windows certificate services? If these events aren't part of a TLS connection, don't use `tls.*`. Instead, I'd recommend using the `file.x509.*` fields. > [@](#): > > Can/should I add field that don't exist in the ECS? for example If I want to keep a record of the user who deleted a certificate, can I rename "event.userdata.certnotificationdata.accountname" to "tls.client.accountname"? Adding custom fields is fine if you follow the [best practices](https://www.elastic.co/guide/en/ecs/current/ecs-custom-fields-in-ecs.html). In this case, however, I'd suggest using the top-level `user.*` fields to capture the record of the user who performed the event. By doing this, you can query across other normalized events using `user.*` fields. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 21, 2022, 2:58pm UTC](https://discuss.elastic.co/t/need-some-advice-regarding-data-ingestion/299859/3 "2022-04-21T14:58:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.