elastic/ecs

Elastic Common Schema (ECS) is a standardized field specification for ingesting and correlating data into Elasticsearch.

ECS solves the problem of inconsistent data structure across diverse sources by defining a common set of fields that enable correlation between logs, metrics, IT operations analytics, and security analytics. The approach works by establishing a shared schema that data sources conform to before ingestion, allowing downstream analysis and correlation to operate on predictable field names and structures.

Organizations should adopt ECS when building observability or security analytics platforms on Elasticsearch where data arrives from multiple sources. It suits projects that need to correlate events across different domains—such as connecting application logs with infrastructure metrics or security events. The tool shares common ground with OpenTelemetry Semantic Conventions, indicating alignment with broader industry standardization efforts, though the README does not compare ECS directly to alternative schema approaches.

The project uses an RFC process for substantial schema changes, ensuring deliberate evolution of the specification. The team publishes improvements following semantic versioning, with major releases generally aligned to Elastic Stack major versions. Generated artifacts can be produced from the schema definition, supporting integration into various downstream tools and systems.