Issue / roadmap suggestion posted here at the suggestion of some of the devs.

Elastic Common Schema has provided a unified format for logs ingested using Beats in those cases where a module for parsing and mapping the events in the log is available. However, it can be difficult to parse and map events to ECS for the log sources for which a module is not available.

It would be nice to have a shared knowledge base for previous log sources that have been mapped to ECS. This would make converting new log sources to ECS significantly easier, as there would be a central location with examples of previous log sources that have been converted to ECS. Right now, that is scattered across various repos where it is relatively difficult to find.

The knowledge base could take a similar form to the grok-patterns repo.