Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fields that contain protocol names like should have normalized capitalization #251

Closed
webmat opened this issue Dec 7, 2018 · 6 comments
Closed

Fields that contain protocol names like should have normalized capitalization #251

webmat opened this issue Dec 7, 2018 · 6 comments
Assignees
@webmat

Comments

@webmat
Copy link
Contributor

webmat commented Dec 7, 2018

I think lowecase would make sense. Thoughts?

Fields in question:

  • network.transport
  • network.type
  • network.application
  • network.protocol
@webmat webmat self-assigned this Dec 7, 2018
@webmat webmat mentioned this issue Dec 7, 2018
Merged
@webmat webmat changed the title Fields with protocol names like should have normalized capitalization Fields contained protocol names like should have normalized capitalization Dec 7, 2018
@webmat
Copy link
Contributor Author

webmat commented Dec 7, 2018

Ping @andrewkroh @adriansr

@webmat webmat changed the title Fields contained protocol names like should have normalized capitalization Fields that contain protocol names like should have normalized capitalization Dec 7, 2018
@adriansr
Copy link
Contributor

adriansr commented Dec 7, 2018

+1 to lowercase

@MikePaquette
Copy link
Contributor

+1 for normalizing case of these fields to lowercase. This is related to #220 where this restriction could be included in a validation column in the ECS specification, perhaps with Regex for the check.

@webmat webmat mentioned this issue Dec 7, 2018
Merged
@andrewkroh
Copy link
Member

Applying a normalizer in the generated template would be a nice addition because it would normalize both the ingested data and the search queries from users.

@ruflin
Copy link
Contributor

ruflin commented Dec 7, 2018 •
edited
Loading

I like this idea. We could make this as part of our template.

@andrewkroh Could you open a separate GIthub issue with this idea?

@andrewkroh
Copy link
Member

I created #260.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@webmat webmat

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@webmat @ruflin @andrewkroh @adriansr @MikePaquette