# elastic/ecs

Repository: https://github.com/elastic/ecs
Canonical: https://ross.abutalabs.com/products/elastic-ecs
Homepage: https://www.elastic.co/what-is/ecs
Language: Python
License: Apache-2.0
License Family: permissive
Last push: 2026-08-26T14:40:20+00:00

## Health v2 (maintenance only)
Score: 94/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 84, longevity 100
- inputs: {"age_days": 3023, "days_push": 7, "days_rel": 29, "gap_med": 85, "n_releases_24m": 8}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1119, forks 454 (observed 2026-08-28T04:03:39.490884+00:00)

## What it is
Elastic Common Schema (ECS) is an open-source specification defining a common set of fields, data types, and usage hierarchies for ingesting data into Elasticsearch. The repository contains the schema definition plus Python tooling to generate artifacts like field mappings and documentation from it.

## Use cases
- normalize log fields from multiple sources into a common schema
- define consistent field names for Elasticsearch ingest pipelines
- correlate security analytics and IT operations data across sources
- generate Elasticsearch index mappings from a schema definition
- align custom data models with OpenTelemetry semantic conventions
- build reusable dashboards and detection rules across data sources

## When to choose
- you ingest heterogeneous logs and metrics into Elasticsearch and want consistent field names
- you build Elastic integrations or Beats/Agent modules that need schema-compliant fields
- you want reusable Kibana dashboards and detection rules that work across data sources

## When to avoid
- you don't use Elasticsearch or the Elastic Stack
- you need a general-purpose data serialization format rather than an event field schema
- you need OpenTelemetry semantic conventions natively rather than ECS

## Facets
- artifact type: dataset
- maturity: active
- function: serialization, developer-tools, etl
- domain: databases, analytics, security, monitoring, developer-tools
- platform: python, cross-platform
- tags: elastic-common-schema, schema-specification, elasticsearch, log-normalization, field-mapping, opentelemetry, data-modeling, search

## Member repositories
- elastic/ecs (main) score 94

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:39.490884+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:41:10.595051+00:00, confidence not recorded.
  - readme: https://github.com/elastic/ecs (fetched 2026-08-28T04:03:39.490884+00:00, sha 4d51d1e346e1)
  - homepage: https://www.elastic.co/what-is/ecs (fetched 2026-08-29T12:45:23.730226+00:00, sha 6347b87f0a61)
  - site_page: https://www.elastic.co/about (fetched 2026-08-29T12:45:23.739442+00:00, sha dcc190ae197d)
  - site_page: https://www.elastic.co/getting-started (fetched 2026-08-29T12:45:23.743031+00:00, sha 7de41ab1d939)
  - site_page: https://www.elastic.co/docs (fetched 2026-08-29T12:45:23.747204+00:00, sha c4139162fd2c)
  - site_page: https://www.elastic.co/virtual-events/getting-started-elasticsearch (fetched 2026-08-29T12:45:23.752970+00:00, sha 7650d67f24da)
  - site_page: https://www.elastic.co/partners/ai-ecosystem (fetched 2026-08-29T12:45:23.741267+00:00, sha 87dba7e5abe6)
  - site_page: https://www.elastic.co/integrations/data-integrations (fetched 2026-08-29T12:45:23.744774+00:00, sha 75f0e785f92a)
  - site_page: https://www.elastic.co/search-labs (fetched 2026-08-29T12:45:23.749242+00:00, sha 4474e57454b5)
  - site_page: https://www.elastic.co/pricing (fetched 2026-08-29T12:45:23.750918+00:00, sha 6ab7886d790c)
- Data as of 2026-08-30T08:39:29.467469+00:00.