Elastic Common Schema

Elastic Common Schema (ECS) defines common fields for logs, metrics, security telemetry, and observability data so events from different sources can be queried and correlated consistently.

This skill is generated from the latest supported ECS release in this repository: v9.5.0 / 9.5.0. Use the YAML files as the authoritative reference for exact field names, fieldsets, types, levels, allowed values, normalization hints, reuse metadata, and OpenTelemetry relations. Use the Markdown docs only for conceptual guidance, mapping examples, and implementation conventions. If a field, fieldset, allowed value, or relation is not present in the YAML data, say that it is not documented here.

Data files

• Use fields.yaml to find a dotted ECS field and then load the referenced fields/<field>.yaml file.
• Use fieldsets.yaml to choose a fieldset and then load the referenced fieldsets/<fieldset>.yaml file.
• Use categorization.yaml for event.kind, event.category, event.type, event.outcome, allowed values, and expected category/type combinations.
• Use otel.yaml as the compact ECS-keyed crosswalk for OpenTelemetry relations.
• Use source.md for release provenance, source artifacts, copied docs, referenced upstream docs, and counts.

Complementary docs