ecs VS logstash-output-elasticsearch

Elastic Common Data Model (ECS) sample data: Although intended for the Elastic Stack, you can adapt these sample logs for use in Splunk. The repository contains logs from various sources, such as network traffic, security events, and web server logs: https://github.com/elastic/ecs/tree/master/generated/samples

// Base represents the base schema type defined by the Elastic Common Schema (ECS). // // See https://github.com/elastic/ecs/blob/main/schemas/base.yml type Base struct { Timestamp *time.Time json:"@timestamp" Tags string json:"tags,omitempty" Labels map[string]any json:"labels,omitempty" Message string json:"message,omitempty" }

To move ECS ahead, we're adding the latest data types from current Elasticsearch like wildcard (https://github.com/elastic/ecs/blob/master/experimental/generated/elasticsearch/7/template.json#L30) or histogram. It won't be successful if we are only tied to the common denominator of data types in terms of space efficiency, performance, features,...

Because ilm_rollover_alias does not support dynamic variable substitution (i.e., the ability to set the dynamic value of a field such as host.env into a string template), we must create one output configuration for each known environment and control their application with IF-ELSE statements.

The roadmap is public, the commits are public. People are contributing code. Right now OpenSearch plugins are 100% compatible with ElasticSearch plugins. Not sure how long that will last. We might see more sabotage being done from Elastic. https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/1005