A few places in the docs (e.g., https://www.elastic.co/guide/en/ecs/current/ecs-http.html, https://www.elastic.co/guide/en/ecs/current/ecs-network.html) have this phrasing:
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
But it looks like that doc section got removed in https://github.com/elastic/ecs/pull/400/files#diff-4011c9c185cee17fb59160d47c1b81dfL12
Seems like https://www.elastic.co/guide/en/ecs/current/ecs-guidelines.html is probably the new location to reference but it lacks the Lowercase Capitalization section that we seem to be referring to in that comment.
I think the value lowercasing advice might also apply to log.leve in https://www.elastic.co/guide/en/ecs/current/ecs-log.html, but would be good to clear up the intention of the existing docs before I open an issue on that I think.
A few places in the docs (e.g., https://www.elastic.co/guide/en/ecs/current/ecs-http.html, https://www.elastic.co/guide/en/ecs/current/ecs-network.html) have this phrasing:
But it looks like that doc section got removed in https://github.com/elastic/ecs/pull/400/files#diff-4011c9c185cee17fb59160d47c1b81dfL12
Seems like https://www.elastic.co/guide/en/ecs/current/ecs-guidelines.html is probably the new location to reference but it lacks the Lowercase Capitalization section that we seem to be referring to in that comment.
I think the value lowercasing advice might also apply to log.leve in https://www.elastic.co/guide/en/ecs/current/ecs-log.html, but would be good to clear up the intention of the existing docs before I open an issue on that I think.