Description of the issue:
Elasticsearch since v7 has added support for a date_nanos type, supporting timestamps with nanosecond resolution, but the ECS @timestamp is a date supporting only millisecond resolution.
It would be nice if ECS had official fields for storing nanosecond resolution timestamps that would also be properly supported by beats, beats modules and the configurations they preload into Kibana.
How this should interact with the existing required @timestamp field is something to be considered.
Any additional context or examples:
https://www.elastic.co/guide/en/ecs/current/ecs-base.html
https://www.elastic.co/guide/en/elasticsearch/reference/current/date_nanos.html
Description of the issue:
Elasticsearch since v7 has added support for a
date_nanostype, supporting timestamps with nanosecond resolution, but the ECS@timestampis adatesupporting only millisecond resolution.It would be nice if ECS had official fields for storing nanosecond resolution timestamps that would also be properly supported by beats, beats modules and the configurations they preload into Kibana.
How this should interact with the existing required
@timestampfield is something to be considered.Any additional context or examples:
https://www.elastic.co/guide/en/ecs/current/ecs-base.html
https://www.elastic.co/guide/en/elasticsearch/reference/current/date_nanos.html