---
title: Wired streams field naming
description: Learn how wired streams normalize field names across the logs.otel and logs.ecs endpoints.
url: https://www.elastic.co/elastic/docs-builder/docs/3717/solutions/observability/streams/wired-streams-field-naming
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Observability
  - Elastic Stack
  - Elasticsearch
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview since 9.2
---

# Wired streams field naming
When data is ingested into a wired stream, field names are normalized depending on which endpoint you use. Understanding how fields are mapped helps you write accurate queries and processing rules.

## Field naming by endpoint

<applies-switch>
  <applies-item title="{ serverless: preview, stack: preview 9.4+ }" applies-to="Elastic Cloud Serverless: Preview, Elastic Stack: Preview since 9.4">
    Field naming depends on the endpoint you use.

    ### `logs.ecs` endpointData ingested into the `logs.ecs` endpoint is stored in the original ECS field names without being transformed. The fields remain as shown in the "ECS field" column in the [field naming table](#streams-field-naming-table).


    ### `logs.otel` endpointData ingested into the `logs.otel` endpoint is stored in OTel format. ECS fields are translated to their OTel semantic convention equivalents, so data is consistently structured and OTTL-expressible.
    When data is ingested into a wired stream, it's automatically translated into this normalized format:
    - Standard ECS documents are converted to OTel fields (`message → body.text`, `log.level → severity_text`, `host.name → resource.attributes.host.name`, and so on).
    - Custom fields are stored under `attributes.*`.
    To preserve backward-compatible querying, Streams creates ECS field name aliases on the ingested data, so queries using ECS field names continue to work even though the data is stored in OTel format.Refer to the [field naming table](#streams-field-naming-table) for ECS fields and corresponding OTel fields.
  </applies-item>

  <applies-item title="stack: preview 9.2-9.3" applies-to="Elastic Stack: Preview from 9.2 to 9.3">
    Data ingested into the `/logs` endpoint is stored and processed in a normalized OpenTelemetry (OTel)–compatible format. This format aligns ECS fields with OTel semantic conventions so all data is consistently structured and OTTL-expressible.Data ingested into a wired stream is automatically translated into this normalized format:
    - Streams converts standard ECS documents to OTel fields (`message → body.text`, `log.level → severity_text`, `host.name → resource.attributes.host.name`, and so on).
    - Streams stores custom fields under `attributes.*`.
    To preserve backward-compatible querying, Streams creates ECS field name aliases on the ingested data, so queries using ECS field names continue to work even though the data is stored in OTel format.Refer to the [field naming table](#streams-field-naming-table) for ECS fields and corresponding OTel fields.
  </applies-item>
</applies-switch>


## Field naming table

The following table lists ECS fields and their corresponding OTel fields.

| ECS field      | OTel field                      |
|----------------|---------------------------------|
| `message`      | `body.text`                     |
| `log.level`    | `severity_text`                 |
| `span.id`      | `span_id`                       |
| `trace.id`     | `trace_id`                      |
| `host.name`    | `resource.attributes.host.name` |
| `host.ip`      | `resource.attributes.host.ip`   |
| `custom_field` | `attributes.custom_field`       |