Skip to content

[Filebeat] Allow modules to set the ecs.version field value #17688

Closed

Description

Describe the enhancement:

As a user of Filebeat modules I would like the ECS version number (ecs.version) to reflect what version the data from the module comforms to rather than what version of the schema has been imported by libbeat.

Describe a specific use case for the enhancement or feature:

It's helpful to have an accurate ecs.version field in the data when you are trying to build queries for the data. You might need one query for earlier versions and then can use a generic query for the later versions that have categories and types.

It will also serve as documentation of when the module was last updated for ECS.

Relates: #16089

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

Labels

FilebeatFilebeatecsneeds_teamIndicates that the issue/PR needs a Team:* label

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions