Hi Elastic folks,
I have a proposal to improve your documentation for the Elastic Common Schema. I would suggest to reference the filebeat modules for common log sources in the ECS documentation. E.g. under Additional Information.
I just noticed those after I put some effort in doing my own ECS normalization of PANOS logs via logstash. Would have helped me a great time to borrow from the module documentation and the ingest pipeline to not fully come up with my own mapping.
Anyhow could be a great pointer in the ECS documentation. Kind of like "And here is how we at Elastic would normalize these common log sources". And to really make our lifes a lot easier you could also provide a logstash config doing the same adaption like the corresponding input.yml and pipeline.yml. After all some of us use logstash for the whole log parsing instead of ingest pipelines.