Description of the issue:
The related.* field set in ECS 1.x uses singular names. As suggested per an additional remark in #863 , using plural names would better align with the guidelines.
Any additional context or examples:
related.hash => related.hashes
related.ip => related.ips
related.user => related.users
related.host => related.hosts (not final)
Description of the issue:
The
related.*field set in ECS 1.x uses singular names. As suggested per an additional remark in #863 , using plural names would better align with the guidelines.Any additional context or examples:
related.hash=>related.hashesrelated.ip=>related.ipsrelated.user=>related.usersrelated.host=>related.hosts(not final)