I found a number of Fleet integrations referencing ECS fields that should not exist. For example, the as (autonomous system) field set should not be used at the top-level. The only valid "reuse" locations are specified in the schema. I think it should be treated as an error to reference an ECS field outside of it's prescribed field reuse locations.
From the ECS docs:
The generated ecs_flat.yml already takes field reuse locations into account so this could be used when resolving the external ECS definitions to simplify logic in elastic-package.
Linked below are the fields I found that don't exist in ECS (note that this is checked against ECS 8.2 and some of these integrations are building against earlier ECS versions, so there are some false positives for fields like process.ppid).
https://gist.github.com/andrewkroh/35000805a649a4137e59251bc712b0e0#file-invalid_ecs_fields-md
I found a number of Fleet integrations referencing ECS fields that should not exist. For example, the
as(autonomous system) field set should not be used at the top-level. The only valid "reuse" locations are specified in the schema. I think it should be treated as an error to reference an ECS field outside of it's prescribed field reuse locations.From the ECS docs:
The generated
ecs_flat.ymlalready takes field reuse locations into account so this could be used when resolving the external ECS definitions to simplify logic in elastic-package.Linked below are the fields I found that don't exist in ECS (note that this is checked against ECS 8.2 and some of these integrations are building against earlier ECS versions, so there are some false positives for fields like
process.ppid).https://gist.github.com/andrewkroh/35000805a649a4137e59251bc712b0e0#file-invalid_ecs_fields-md