Elastic Common Schema https://www.elastic.co/what-is/ecs
Find a file
Michael Wolf a661e2d084
Advanced developer docs (#2569)
This adds advanced developer documentation for ECS tooling, which documents all steps of the generation pipeline, adds information on the ECS-OTel mapping process, adds pydoc to all functions. It also adds documentation on field re-use, subset and exclude filters.

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-03-19 13:54:48 -07:00
.github Update stalebot so inactive PRs go stale at 30 days and auto-close PRs after 45 days (#2590) 2026-03-18 16:25:02 +01:00
docs Advanced developer docs (#2569) 2026-03-19 13:54:48 -07:00
experimental Increase total fields limit from 2000 to 2500 (#2584) 2026-03-16 19:35:08 +01:00
generated Increase total fields limit from 2000 to 2500 (#2584) 2026-03-16 19:35:08 +01:00
rfcs Advance RFC 0049 (entity store) to stage 2 (#2537) 2025-09-26 07:50:30 -07:00
schemas Clarify url.query usage to specify full query string format (#2488) 2025-12-16 09:38:00 -05:00
scripts Advanced developer docs (#2569) 2026-03-19 13:54:48 -07:00
.backportrc.json adding backport option for 9.3 (#2575) 2025-12-16 15:20:27 -05:00
.editorconfig Add .editorconfig file for consistent formatting. (#44) 2018-07-25 12:38:17 +02:00
.gitattributes Add union merge for CHANGELOG to reduce merge conflicts (#15) 2018-06-06 02:21:20 -04:00
.gitignore Introduce process.* field set reuse filtering (#1847) 2022-03-22 14:44:33 -05:00
.mergify.yml Create .mergify.yml with rule enabling forwardporting of documentation changes (#2504) 2025-08-22 16:34:36 -03:00
CHANGELOG.md Forward port 9.3 release details (#2581) 2026-02-05 12:18:48 -05:00
CHANGELOG.next.md Increase total fields limit from 2000 to 2500 (#2584) 2026-03-16 19:35:08 +01:00
CONTRIBUTING.md minor updates to the submitting changes section of the contributing guide (#2501) 2025-07-24 09:59:20 -04:00
LICENSE.txt Add apache 2 license to ECS (#190) 2018-11-29 16:14:52 +01:00
Makefile Fix entity generation (#2548) 2025-10-09 12:20:24 -07:00
NOTICE.txt Add license notice section to README (#1651) 2021-11-09 09:15:45 -06:00
otel-semconv-version update semconv to 1.38 version (#2563) 2025-11-04 14:29:33 +01:00
README.md Special guidance for ECS contribtions during ECS donation (#2325) 2024-04-05 11:55:58 -07:00
renovate.json Add renovate.json (#2352) 2024-08-13 13:39:17 -07:00
stages.html [DOCS] Update refs from master to main in USAGE.md etc (#1658) 2021-11-11 14:30:03 +01:00
USAGE.md Advanced developer docs (#2569) 2026-03-19 13:54:48 -07:00
version Update main version to 9.4.0-dev (#2573) 2025-12-16 15:16:50 -05:00

Supported Python versions Unit Tests Chat

Elastic Common Schema (ECS)

The Elastic Common Schema (ECS) defines a common set of fields for ingesting data into Elasticsearch. A common schema helps you correlate data from sources like logs and metrics or IT operations analytics and security analytics.

ECS Donation to OpenTelemetry

In April 2023, OpenTelemetry and Elastic made an important joint announcement. In this announcement, we shared our intention to achieve convergence of ECS and OTel Semantic Conventions into a single standard maintained by OpenTelemetry.

Special guidance is provided during the donation period. Please review the contribution guide.

Documentation

The ECS reference is published on the main Elastic documentation website.

Visit the official ECS Reference Documentation.

Getting Started

Please review the tooling usage guide to get started using the tools provided in this repo.

Contributing

If you're looking to contribute to ECS, you're invited to look at our contribution guide. Substantial changes to ECS are completed through our RFC process.

Generated artifacts

Various kinds of files or programs can be generated based on ECS. You can learn more in generated/README.md

Releases of ECS

The main branch of this repository should never be considered an official release of ECS. You can browse official releases of ECS here.

The ECS team publishes improvements to the schema by following Semantic Versioning. Generally major ECS releases are planned to be aligned with major Elastic Stack releases.

License

This software is licensed under the Apache License, version 2 ("ALv2"), quoted below.

Copyright 2018-2021 Elasticsearch https://www.elastic.co

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.