Caveats

• There's a lot of juicy unparsed information in the nginx error logs (IP, file path, server address, etc). This conversion doesn't address this.

Renames

• nginx.error.level => log.level
• nginx.error.pid => process.pid
• nginx.error.tid => process.thread.id
• nginx.error.message => message
• read_timestamp => event.created

TODO

• Coerce thread ID, PID, conn ID
• read_timestamp => event.created
• Alias renamed fields to their ECS counterpart, not forgetting migration: true
• Document field migrations in ecs-migration.yml
• Changelog