Elastic Common Schema (ECS) release notes

This page applies to
Versions

Review the changes, fixes, and more in each version of ECS.

To check for security updates, go to Security announcements for the Elastic stack.

  • Add alpha field maturity attribute, mirroring beta with mutual exclusion. #2599
  • Document field stability definitions (alpha, beta, GA) in design principles. #2599
  • Increase composable template total_fields.limit from 2000 to 2500. #2584
  • Remove the experimental/ build pipeline and unused cgroup.* fields; alpha and beta fields now live in schemas/. #2599
  • Add entity.attributes.*, entity.lifecycle.last_activity, and entity.relationships.* fields from RFC 0054. Introduce reusable entity_reference field set for shared relationship identifier keys. #2648
  • Added details for implementation of url.query to avoid ambiguity #2488
  • Added cloud and orchestrator as allowed values for entity.type. #2567
  • Allow entity fields at root level. #2567
  • Added entity.target for self-nesting. #2567
  • Added the target field to be nested under host #2571
  • Add device value to event.type #2524
  • Add new device fields #2530
  • Added entity fieldset as beta #2537
  • Add gen_ai fields to schema as beta. #2475
  • Allow Unicode characters in generated ECS yml files. #2478
  • Update semconv version used in file generation to v1.34.0 #2483
  • Add origin_referrer_url and origin_url fields, which indicate the origin information to the file, process and dll schemas #2441
  • Add thumbprint_sha256 to code_signature schema. #2452
  • Fix otel urls for fieldsets with underscores. #2486
  • Define base encoding of x509.serial_number. #2383
  • Restrict the encoding of x509.serial_number to base 16. #2398
  • Promote beta fields to GA. #2411
  • Add mapping between ECS and OpenTelemetry. #2415
  • Set synthetic_source_keep = none on fields that represent sets. #2422
  • Increase ignore_above value for url.query. #2424
  • Add origin_referrer_url and origin_url fields, which indicate the origin information to the file, process and dll schemas. #2441
  • Fix link rendering issues and usage of http in links. #2423
  • Fix link rendering for additional fields. #2458