I would like to propose two new event fields that I think would be useful

• event.level (keyword)
• event.sequence (long)

event.level is the human readable companion field to event.severity, essentially identical in use to log.level (which could be deprecated/removed in favor of event.level).

event.sequence is another integrity field (like event.hash) for event sources that emit events in sequence, to detect missing events and/or order events that may have time stamps based on receipt time rather than emit time (syslog over UDP comes to mind).

While I'm on the topic of the Event group, is event.id meant to be a unique id for for an instance of an event (such that two identical events would have different and unique event.id) or is it meant to handle the case where events have numeric or coded identifiers, e.g.:
%ASA-3-610001: NTP daemon interface interface_name : Packet denied from IP_address
might look something like the following in ECS 1.0

{
  ...
  "message": "000045: %ASA-3-610001: NTP daemon interface interface_name : Packet denied from IP_address",
  "event": {
    "action": "denied",
    "category": "firewall",
    "id": "610001",
    "severity": 3,
    "level": "ERROR",
    "sequence": 45,
    "version": "1.0.0"
  }
  ...
}