Caveats

• Got rid of workaround for an Ingest Node issue fixed in 5.0, in 2016

Renames

• mysql.error.message => message
• mysql.error.level => log.level
• mysql.error.thread_id => process.thread.id
• mysql.slowlog.ip => source.ip
• mysql.slowlog.host => source.domain
• mysql.slowlog.user => user.name

TODO

• Add -expected.json log for the error logs
• Get rid of workaround for Ingest Node's grok can't set the same field from two patterns elasticsearch#22117, which was fixed in 5.0
• Set event.created
• Coerce int fields: process.thread.id, mysql.slowlog.id, mysql.slowlog.rows_sent, mysql.slowlog.rows_examined and mysql.slowlog.timestamp
• Coerce float fields: mysql.slowlog.query_time.sec, mysql.slowlog.lock_time.sec
• Populate event.duration based on mysql.slowlog.query_time.sec
• Alias renamed fields to their ECS counterpart, not forgetting migration: true
• Document field migrations in ecs-migration.yml
• Changelog