Currently the custom input packages (like TCP/UDP, httpjson etc) comes with the bare minimum of ECS mapping, very similar to how custom inputs worked in Filebeat, however this does not produce the best outcome for the end users, as functionality like add_*_metadata for example produces ECS fields, especially host which is enabled by default.

This issue is to discuss what the best practice would be for all Custom Input packages, and then used to track the status of applying any decided changes.

Packages:

• httpjson
• http_endpoint
• eventhub
• s3
• tcp
• udp
• filestream
• log
• kafka
• winlog