ecs
Loading

Field & Attributes Alignment

The following table gives an overview of mappings between individual ECS fields (in ECS version 9.1.0-dev) and corresponding OTel semantic convention attributes (in SemConv version 1.29.0).

ECS Field Relation OTel Semantic Conventions Attribute Stability
Base Fields
@timestamp otlp time_unix_nano stable
@timestamp otlp observed_time_unix_nano stable
@timestamp otlp start_time_unix_nanoNote: On logs, events and metrics, time_unix_nano defines the time of the event. For logs, observed_time_unix_nano defines the time when the event was observed by the collection system. On spans, start_time_unix_nano represents the start time of the span. stable
labels related k8s.pod.label experimental
labels related container.label experimental
message otlp bodyNote: The body in OTLP is of type Any and can be either an unstructured log message or a structured event. stable
Client Fields
client.address match client.address stable
client.port match client.port stable
Cloud Fields
cloud.account.id match cloud.account.id experimental
cloud.availability_zone match cloud.availability_zone experimental
cloud.provider match cloud.provider experimental
cloud.region match cloud.region experimental
cloud.service.name equivalent cloud.platform experimental
Container Fields
container.cpu.usage metric container.cpu.usage experimental
container.id match container.id experimental
container.image.hash.all equivalent container.image.repo_digests experimental
container.image.name match container.image.name experimental
container.image.tag equivalent container.image.tags experimental
container.labels related container.label experimental
container.memory.usage metric container.memory.usage experimental
container.name match container.name experimental
container.runtime match container.runtime experimental
Data Stream Fields
data_stream.dataset not-applicable Not applicable.
data_stream.namespace not-applicable Not applicable.
data_stream.type not-applicable Not applicable.
Destination Fields
destination.address match destination.address experimental
destination.port match destination.port experimental
Device Fields
device.id match device.id experimental
device.manufacturer match device.manufacturer experimental
device.model.identifier match device.model.identifier experimental
device.model.name match device.model.name experimental
DNS Fields
dns.question.name match dns.question.name experimental
ECS Fields
ecs.version not-applicable Not applicable.
Error Fields
error.message equivalent exception.message stable
error.stack_trace equivalent exception.stacktrace stable
error.type match error.type stable
FaaS Fields
faas.coldstart match faas.coldstart experimental
faas.execution equivalent faas.invocation_id experimental
faas.name match faas.name experimental
faas.trigger.type equivalent faas.trigger experimental
faas.version match faas.version experimental
File Fields
file.accessed match file.accessed experimental
file.attributes match file.attributes experimental
file.created match file.created experimental
file.ctime equivalent file.changed experimental
file.directory match file.directory experimental
file.extension match file.extension experimental
file.fork_name match file.fork_name experimental
file.gid equivalent file.group.id experimental
file.group equivalent file.group.name experimental
file.inode match file.inode experimental
file.mode match file.mode experimental
file.mtime equivalent file.modified experimental
file.name match file.name experimental
file.owner equivalent file.owner.name experimental
file.path match file.path experimental
file.size match file.size experimental
file.target_path equivalent file.symbolic_link.target_path experimental
file.uid equivalent file.owner.id experimental
Geo Fields
geo.city_name equivalent geo.locality.name experimental
geo.continent_code equivalent geo.continent.code experimental
geo.country_iso_code equivalent geo.country.iso_code experimental
geo.location related geo.location.lat experimental
geo.location related geo.location.lon experimental
geo.postal_code match geo.postal_code experimental
geo.region_iso_code equivalent geo.region.iso_code experimental
Host Fields
host.architecture equivalent host.arch experimental
host.cpu.usage metric system.cpu.utilization experimental
host.disk.read.bytes metric system.disk.io experimental
host.disk.write.bytes metric system.disk.io experimental
host.id match host.id experimental
host.ip match host.ip experimental
host.mac match host.mac experimental
host.name match host.name experimental
host.network.egress.bytes metric system.network.io experimental
host.network.egress.packets metric system.network.packets experimental
host.network.ingress.bytes metric system.network.io experimental
host.network.ingress.packets metric system.network.packets experimental
host.type match host.type experimental
host.uptime metric system.uptime experimental
HTTP Fields
http.request.body.bytes equivalent http.request.body.size experimental
http.request.bytes equivalent http.request.size experimental
http.request.method equivalent http.request.method_original stable
http.request.method conflict http.request.methodNote: http.request.method in SemConv is the known, normalized, upper case value of the request method, other than the ECS' http.request.method that retains casing from the original event. stable
http.response.body.bytes equivalent http.response.body.size experimental
http.response.bytes equivalent http.response.size experimental
http.response.status_code match http.response.status_code stable
http.version related network.protocol.name stable
http.version related network.protocol.versionNote: In OTel SemConv, network.protocol.version specifies the HTTP version if the value of network.protocol.name is http. stable
Log Fields
log.file.path match log.file.path experimental
log.level otlp severity_text stable
Network Fields
network.protocol equivalent network.protocol.name stable
network.transport match network.transport stable
network.type match network.type stable
Operating System Fields
os.full equivalent os.description experimental
os.name match os.name experimental
os.type conflict os.typeNote: The expected values in ECS for os.type do not correspond with the values defined in semantic conventions! experimental
os.version match os.version experimental
Process Fields
process.args equivalent process.command_args experimental
process.args_count match process.args_count experimental
process.command_line match process.command_line experimental
process.executable equivalent process.executable.path experimental
process.real_user.id match process.real_user.id experimental
process.saved_user.id match process.saved_user.id experimental
process.user.id match process.user.id experimental
process.interactive match process.interactive experimental
process.real_user.name match process.real_user.name experimental
process.saved_user.name match process.saved_user.name experimental
process.user.name match process.user.name experimental
process.group_leader.pid match process.group_leader.pid experimental
process.pid match process.pid experimental
process.session_leader.pid match process.session_leader.pid experimental
process.title match process.title experimental
process.uptime metric process.uptime experimental
process.vpid match process.vpid experimental
process.working_directory match process.working_directory experimental
Related Fields
related.hash not-applicable Not applicable.
related.hosts not-applicable Not applicable.
related.ip not-applicable Not applicable.
related.user not-applicable Not applicable.
Server Fields
server.address match server.address stable
server.port match server.port stable
Service Fields
service.environment equivalent deployment.environment.name experimental
service.name match service.name stable
service.node.name equivalent service.instance.id experimental
service.version match service.version stable
Source Fields
source.address match source.address experimental
source.port match source.port experimental
TLS Fields
tls.cipher match tls.cipher experimental
tls.client.certificate match tls.client.certificate experimental
tls.client.certificate_chain match tls.client.certificate_chain experimental
tls.client.hash.md5 match tls.client.hash.md5 experimental
tls.client.hash.sha1 match tls.client.hash.sha1 experimental
tls.client.hash.sha256 match tls.client.hash.sha256 experimental
tls.client.issuer match tls.client.issuer experimental
tls.client.ja3 match tls.client.ja3 experimental
tls.client.not_after match tls.client.not_after experimental
tls.client.not_before match tls.client.not_before experimental
tls.client.subject match tls.client.subject experimental
tls.client.supported_ciphers match tls.client.supported_ciphers experimental
tls.curve match tls.curve experimental
tls.established match tls.established experimental
tls.next_protocol match tls.next_protocol experimental
tls.resumed match tls.resumed experimental
tls.server.certificate match tls.server.certificate experimental
tls.server.certificate_chain match tls.server.certificate_chain experimental
tls.server.hash.md5 match tls.server.hash.md5 experimental
tls.server.hash.sha1 match tls.server.hash.sha1 experimental
tls.server.hash.sha256 match tls.server.hash.sha256 experimental
tls.server.issuer match tls.server.issuer experimental
tls.server.ja3s match tls.server.ja3s experimental
tls.server.not_after match tls.server.not_after experimental
tls.server.not_before match tls.server.not_before experimental
tls.server.subject match tls.server.subject experimental
Tracing Fields
span.id otlp span_id stable
trace.id otlp trace_id stable
transaction.id not-applicable Not applicable.
URL Fields
url.domain match url.domain experimental
url.extension match url.extension experimental
url.fragment match url.fragment stable
url.full match url.full stable
url.original match url.original experimental
url.path match url.path stable
url.port match url.port experimental
url.query match url.query stable
url.registered_domain match url.registered_domain experimental
url.scheme match url.scheme stable
url.subdomain match url.subdomain experimental
url.top_level_domain match url.top_level_domain experimental
User Fields
user.email match user.email experimental
user.full_name match user.full_name experimental
user.hash match user.hash experimental
user.id match user.id experimental
user.name match user.name experimental
user.roles match user.roles experimental
User agent Fields
user_agent.name match user_agent.name experimental
user_agent.original match user_agent.original stable
user_agent.version match user_agent.version experimental