Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarify guidelines on ID fields. #349

Merged
merged 1 commit into from
Mar 5, 2019
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -692,14 +692,13 @@ follow the multi-field convention where `text` indexing is nested in the multi-f
### IDs and most codes are keywords, not integers

Despite the fact that IDs and codes (e.g. error codes) are often integers,
this is not always the case.
this is not the case across all systems. IDs can also be alphanumeric, or contain
special characters.
Since we want to make it possible to map as many systems and data sources
to ECS as possible, we default to using the `keyword` type for IDs and codes.

Some specific kinds of codes are always integers, like HTTP status codes.
If those have a specific corresponding specific field (as HTTP status does),
its type can safely be an integer type.
But generic field like `error.code` cannot have this guarantee, and are therefore `keyword`.
For these fields specifically, using `long` can be considered.

# <a name="about-ecs"></a>FAQ

Expand Down
7 changes: 3 additions & 4 deletions docs/implementing.md
Original file line number Diff line number Diff line change
Expand Up @@ -105,11 +105,10 @@ follow the multi-field convention where `text` indexing is nested in the multi-f
### IDs and most codes are keywords, not integers

Despite the fact that IDs and codes (e.g. error codes) are often integers,
this is not always the case.
this is not the case across all systems. IDs can also be alphanumeric, or contain
special characters.
Since we want to make it possible to map as many systems and data sources
to ECS as possible, we default to using the `keyword` type for IDs and codes.

Some specific kinds of codes are always integers, like HTTP status codes.
If those have a specific corresponding specific field (as HTTP status does),
its type can safely be an integer type.
But generic field like `error.code` cannot have this guarantee, and are therefore `keyword`.
For these fields specifically, using `long` can be considered.