ecs-mapping

ecs-mapping copied to clipboard

jamesagarside

Hi, [Data streams](https://www.elastic.co/guide/en/elasticsearch/reference/current/data-streams.html) are now the recommended way of ingesting logs and metrics. Is there a plan to support them with the available pipelines?

s-abdelwahhab

In version 1.9.0.1 there is a note that states "removed template_corelight_temporary_log_holdings". While none of the pipelines name their indices in a way that would trigger this template it does however...

Kytie

Type Error: dns.id and dns.answers.ttl

1

The current DNS pipeline doesnt convert `dns.answers.ttl` which is copied from the Corelight field `TTLs` to the correct type. It seems Corelight sends it as an `array` however the expected...

jamesagarside