Initial discussion for email object

[dainok]

I would like to start a discussion about adding an object for emails or not.
MTA logs could fit in events, but a more detailed log need a specific object.

Questions:

• Makes sense for you? How do you translate MTA logs to ECS schema?
• Can I define an array of objects? Examples: "to" is an array of dicts (address, full name), and attachments would be an array of files.
• Suggested fields to add?

Feel free to comment.

[ebeahan]

Adding email support into the schema is something many users have voiced interest in, and there's been a lot of good discussion in #411. I'd recommend also sharing any thoughts/expectations/ideas to add to the discussion there as well as those comments are extremely useful!

An addition of this scope would definitely be a great candidate for the RFC process we've recently established.

[dainok]

Moving to #411