Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mention ECS Mapper in the main documentation #987

Merged
merged 2 commits into from
Oct 5, 2020
Merged

Mention ECS Mapper in the main documentation #987

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dd62636
Add ECS Mapper
DanRoscigno Sep 30, 2020
5a10770
Flesh out the ECS Mapper primer
webmat Oct 5, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions docs/converting.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,3 +44,18 @@ Here's the recommended approach for converting an existing implementation to {ec
. Set `ecs.version` to the version of the schema you are conforming to. This will
allow you to upgrade your sources, pipelines and content (like dashboards)
smoothly in the future.

[float]
[[ecs-conv-spreasheet]]
==== Using a spreadsheet to plan your migration

Using a spreadsheet to plan the migration from pre-existing source fields to ECS
is a common practice. It's a good way to address each of your fields methodically among colleagues.

If the data source is either a structured log, or if you already have a pipeline
producing events with these non-ECS field names, the tool
https://github.com/elastic/ecs-mapper[ECS Mapper] may help you get started in performing all of these field renames.

After exporting your mapping spreadsheet to CSV, ECS Mapper will convert your field mapping
to equivalent pipelines for Beats, Elasticsearch, and Logstash. Learn more at
https://github.com/elastic/ecs-mapper[ECS Mapper].