Field & Attributes Alignment

The following table gives an overview of mappings between individual ECS fields (in ECS version 9.1.0-dev) and corresponding OTel semantic convention attributes (in SemConv version 1.29.0).

ECS Field	Relation	OTel Semantic Conventions Attribute	Stability
Base Fields
@timestamp		time_unix_nano
	observed_time_unix_nano
	start_time_unix_nano Note: On logs, events and metrics, time_unix_nano defines the time of the event. For logs, observed_time_unix_nano defines the time when the event was observed by the collection system. On spans, start_time_unix_nano represents the start time of the span.
labels		k8s.pod.label
	container.label
message		body Note: The body in OTLP is of type Any and can be either an unstructured log message or a structured event.
Client Fields
client.address		client.address
client.port		client.port
Cloud Fields
cloud.account.id		cloud.account.id
cloud.availability_zone		cloud.availability_zone
cloud.provider		cloud.provider
cloud.region		cloud.region
cloud.service.name		cloud.platform
Container Fields
container.cpu.usage		container.cpu.usage
container.id		container.id
container.image.hash.all		container.image.repo_digests
container.image.name		container.image.name
container.image.tag		container.image.tags
container.labels		container.label
container.memory.usage		container.memory.usage
container.name		container.name
container.runtime		container.runtime
Data Stream Fields
data_stream.dataset [beta]		Not applicable.
data_stream.namespace [beta]		Not applicable.
data_stream.type [beta]		Not applicable.
Destination Fields
destination.address		destination.address
destination.port		destination.port
Device Fields
device.id [beta]		device.id
device.manufacturer [beta]		device.manufacturer
device.model.identifier [beta]		device.model.identifier
device.model.name [beta]		device.model.name
DNS Fields
dns.question.name		dns.question.name
ECS Fields
ecs.version		Not applicable.
Error Fields
error.message		exception.message
error.stack_trace		exception.stacktrace
error.type		error.type
FaaS Fields
faas.coldstart [beta]		faas.coldstart
faas.execution [beta]		faas.invocation_id
faas.name [beta]		faas.name
faas.trigger.type [beta]		faas.trigger
faas.version [beta]		faas.version
File Fields
file.accessed		file.accessed
file.attributes		file.attributes
file.created		file.created
file.ctime		file.changed
file.directory		file.directory
file.extension		file.extension
file.fork_name		file.fork_name
file.gid		file.group.id
file.group		file.group.name
file.inode		file.inode
file.mode		file.mode
file.mtime		file.modified
file.name		file.name
file.owner		file.owner.name
file.path		file.path
file.size		file.size
file.target_path		file.symbolic_link.target_path
file.uid		file.owner.id
Geo Fields
geo.city_name		geo.locality.name
geo.continent_code		geo.continent.code
geo.country_iso_code		geo.country.iso_code
geo.location		geo.location.lat
	geo.location.lon
geo.postal_code		geo.postal_code
geo.region_iso_code		geo.region.iso_code
Host Fields
host.architecture		host.arch
host.cpu.usage		system.cpu.utilization
host.disk.read.bytes		system.disk.io
host.disk.write.bytes		system.disk.io
host.id		host.id
host.ip		host.ip
host.mac		host.mac
host.name		host.name
host.network.egress.bytes		system.network.io
host.network.egress.packets		system.network.packets
host.network.ingress.bytes		system.network.io
host.network.ingress.packets		system.network.packets
host.type		host.type
host.uptime		system.uptime
HTTP Fields
http.request.body.bytes		http.request.body.size
http.request.bytes		http.request.size
http.request.method		http.request.method_original
	http.request.method Note: http.request.method in SemConv is the known, normalized, upper case value of the request method, other than the ECS' http.request.method that retains casing from the original event.
http.response.body.bytes		http.response.body.size
http.response.bytes		http.response.size
http.response.status_code		http.response.status_code
http.version		network.protocol.name
	network.protocol.version Note: In OTel SemConv, network.protocol.version specifies the HTTP version if the value of network.protocol.name is http.
Log Fields
log.file.path		log.file.path
log.level		severity_text
Network Fields
network.protocol		network.protocol.name
network.transport		network.transport
network.type		network.type
Operating System Fields
os.full		os.description
os.name		os.name
os.type		os.type Note: The expected values in ECS for os.type do not correspond with the values defined in semantic conventions!
os.version		os.version
Process Fields
process.args		process.command_args
process.args_count		process.args_count
process.command_line		process.command_line
process.executable		process.executable.path
process.real_user.id		process.real_user.id
process.saved_user.id		process.saved_user.id
process.user.id		process.user.id
process.interactive		process.interactive
process.real_user.name		process.real_user.name
process.saved_user.name		process.saved_user.name
process.user.name		process.user.name
process.group_leader.pid		process.group_leader.pid
process.pid		process.pid
process.session_leader.pid		process.session_leader.pid
process.title		process.title
process.uptime		process.uptime
process.vpid		process.vpid
process.working_directory		process.working_directory
Related Fields
related.hash		Not applicable.
related.hosts		Not applicable.
related.ip		Not applicable.
related.user		Not applicable.
Server Fields
server.address		server.address
server.port		server.port
Service Fields
service.environment [beta]		deployment.environment.name
service.name		service.name
service.node.name		service.instance.id
service.version		service.version
Source Fields
source.address		source.address
source.port		source.port
TLS Fields
tls.cipher		tls.cipher
tls.client.certificate		tls.client.certificate
tls.client.certificate_chain		tls.client.certificate_chain
tls.client.hash.md5		tls.client.hash.md5
tls.client.hash.sha1		tls.client.hash.sha1
tls.client.hash.sha256		tls.client.hash.sha256
tls.client.issuer		tls.client.issuer
tls.client.ja3		tls.client.ja3
tls.client.not_after		tls.client.not_after
tls.client.not_before		tls.client.not_before
tls.client.subject		tls.client.subject
tls.client.supported_ciphers		tls.client.supported_ciphers
tls.curve		tls.curve
tls.established		tls.established
tls.next_protocol		tls.next_protocol
tls.resumed		tls.resumed
tls.server.certificate		tls.server.certificate
tls.server.certificate_chain		tls.server.certificate_chain
tls.server.hash.md5		tls.server.hash.md5
tls.server.hash.sha1		tls.server.hash.sha1
tls.server.hash.sha256		tls.server.hash.sha256
tls.server.issuer		tls.server.issuer
tls.server.ja3s		tls.server.ja3s
tls.server.not_after		tls.server.not_after
tls.server.not_before		tls.server.not_before
tls.server.subject		tls.server.subject
Tracing Fields
span.id		span_id
trace.id		trace_id
transaction.id		Not applicable.
URL Fields
url.domain		url.domain
url.extension		url.extension
url.fragment		url.fragment
url.full		url.full
url.original		url.original
url.path		url.path
url.port		url.port
url.query		url.query
url.registered_domain		url.registered_domain
url.scheme		url.scheme
url.subdomain		url.subdomain
url.top_level_domain		url.top_level_domain
User Fields
user.email		user.email
user.full_name		user.full_name
user.hash		user.hash
user.id		user.id
user.name		user.name
user.roles		user.roles
User agent Fields
user_agent.name		user_agent.name
user_agent.original		user_agent.original
user_agent.version		user_agent.version