# Trying to be ECS compliance in order to have visual analysis. It's hard! Help needed
**URL:** https://discuss.elastic.co/t/trying-to-be-ecs-compliance-in-order-to-have-visual-analysis-its-hard-help-needed/282370
**Category:** Logstash
**Created:** [August 24, 2021, 3:04pm UTC](https://discuss.elastic.co/t/trying-to-be-ecs-compliance-in-order-to-have-visual-analysis-its-hard-help-needed/282370 "2021-08-24T15:04:13Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@syunusic](https://discuss.elastic.co/u/syunusic)
#### Post date: [August 24, 2021, 3:04pm UTC](https://discuss.elastic.co/t/trying-to-be-ecs-compliance-in-order-to-have-visual-analysis-its-hard-help-needed/282370/1 "2021-08-24T15:04:13Z")
I’m renaming Fortigate’s field names from how Fortinet called them to a ECS compatible one. There is the [integration section](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-fortinet.html#_fortinet_ecs_fields) and there is also the [exported field](https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-fortinet.html#_firewall) section. Which one do I have to follow? Three examples to understand my dilema:
**Example 1:**
Fortinet’s firewall, Fortigate has a field called `action` . In the integration section says that has to be called `event.action` , but in the exported fields section says it’s `fortinet.firewall.action` . Which one should I pick?
**Example 2:**
Foirtigate has a field called `authserver` , which is not present in the integration section, but in the exported fields is called `fortinet.firewall.authserver` . I guess I’ve to pick this one.
**Example 3:**
Fortigate has a field called `filesize` . In integration is called `file.size` and it doesn’t exists in exported fields.
So.. Should I take the names from integration and the rest from exported fields?
Why to do this? Because in alerts I can’t view the visual analysis because “it has some incompatible field mappings” (so far I have all the integration field names, but none from the exported fields section).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 21, 2021, 3:05pm UTC](https://discuss.elastic.co/t/trying-to-be-ecs-compliance-in-order-to-have-visual-analysis-its-hard-help-needed/282370/2 "2021-09-21T15:05:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.