elastic/ecs resource

Health v2 · maintenance only

Adoption not part of the score

1119 stars · 454 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Elastic Common Schema (ECS) is an open-source specification defining a common set of fields, data types, and usage hierarchies for ingesting data into Elasticsearch. The repository contains the schema definition plus Python tooling to generate artifacts like field mappings and documentation from it.

Use cases

• normalize log fields from multiple sources into a common schema
• define consistent field names for Elasticsearch ingest pipelines
• correlate security analytics and IT operations data across sources
• generate Elasticsearch index mappings from a schema definition
• align custom data models with OpenTelemetry semantic conventions
• build reusable dashboards and detection rules across data sources

When to choose

• you ingest heterogeneous logs and metrics into Elasticsearch and want consistent field names
• you build Elastic integrations or Beats/Agent modules that need schema-compliant fields
• you want reusable Kibana dashboards and detection rules that work across data sources

When to avoid

• you don't use Elasticsearch or the Elastic Stack
• you need a general-purpose data serialization format rather than an event field schema
• you need OpenTelemetry semantic conventions natively rather than ECS

Facets

dataset · maturity active

serialization developer-tools etl databases analytics security monitoring developer-tools python cross-platform elastic-common-schema schema-specification elasticsearch log-normalization field-mapping opentelemetry data-modeling search

Member repositories

For agents

markdown · JSON · MCP: product_card(name="elastic/ecs")