Skip to content

Elastic Common Schema (ECS)

What will change

  • Only fields in Emarsys ECS will be indexed, all these fields will be autmatically indexed for every index
    • yellow fields are the extensions to the original ECS fields
  • There will be no dynamic mapping for new fields like in LaaS1
  • You no longer need to ask for field indexing like previously in LaaS2, once ECS is enabled on an index
    • Until globally turned on, you need to create a Change Request with the list of indexes you want us to enable ECS on

What you need to do

  • Find ECS compatible field names
    1. Decide if it needs to be indexed
      • Do not index debug data
      • DO NOT LOG METRICS! For metric based data ask on #area-systec
      • Do not use ECS field names for fields not on dashboards or in alerts/search
    2. Choose a name for the fields
      • Based on the Renaming table find a recommendation if exists
      • In case no recommendation exists check the Emarsys ECS table and choose one
      • If still no luck, ask on #area-systec
  • Modify application/service to use these names when logging
  • Based on the Renaming table there will be temporary renaming/copying in effect
  • Change field names on dashboards and alerts you have