Loading

Field & Attributes Alignment

The following table gives an overview of mappings between individual ECS fields (in ECS version 9.2.0) and corresponding OTel semantic convention attributes (in SemConv version 1.37.0).

ECS Field Relation OTel Semantic Conventions Attribute Stability
Base Fields
@timestamp otlp time_unix_nano stable
@timestamp otlp observed_time_unix_nano stable
@timestamp otlp start_time_unix_nanoNote: On logs, events and metrics, time_unix_nano defines the time of the event. For logs, observed_time_unix_nano defines the time when the event was observed by the collection system. On spans, start_time_unix_nano represents the start time of the span. stable
labels related k8s.pod.label development
labels related container.label development
message otlp bodyNote: The body in OTLP is of type Any and can be either an unstructured log message or a structured event. stable
Client Fields
client.address match client.address stable
client.port match client.port stable
Cloud Fields
cloud.account.id match cloud.account.id development
cloud.availability_zone match cloud.availability_zone development
cloud.provider match cloud.provider development
cloud.region match cloud.region development
cloud.service.name equivalent cloud.platform development
Container Fields
container.cpu.usage metric "&type=code" target="_blank" rel="noopener noreferrer">container.cpu.usage development
container.id match container.id development
container.image.hash.all equivalent container.image.repo_digests development
container.image.name match container.image.name development
container.image.tag equivalent container.image.tags development
container.labels related container.label development
container.memory.usage metric "&type=code" target="_blank" rel="noopener noreferrer">container.memory.usage development
container.name match container.name development
container.runtime equivalent container.runtime.name development
Data Stream Fields
data_stream.dataset not-applicable Not applicable.
data_stream.namespace not-applicable Not applicable.
data_stream.type not-applicable Not applicable.
Destination Fields
destination.address match destination.address development
destination.port match destination.port development
Device Fields
device.id match device.id development
device.manufacturer match device.manufacturer development
device.model.identifier match device.model.identifier development
device.model.name match device.model.name development
DNS Fields
dns.answers related dns.answers development
dns.question.name match dns.question.name development
ECS Fields
ecs.version not-applicable Not applicable.
Error Fields
error.message equivalent exception.message stable
error.stack_trace equivalent exception.stacktrace stable
error.type match error.type stable
FaaS Fields
faas.coldstart match faas.coldstart development
faas.execution equivalent faas.invocation_id development
faas.name match faas.name development
faas.trigger.type equivalent faas.trigger development
faas.version match faas.version development
File Fields
file.accessed match file.accessed development
file.attributes match file.attributes development
file.created match file.created development
file.ctime equivalent file.changed development
file.directory match file.directory development
file.extension match file.extension development
file.fork_name match file.fork_name development
file.gid equivalent file.group.id development
file.group equivalent file.group.name development
file.inode match file.inode development
file.mode match file.mode development
file.mtime equivalent file.modified development
file.name match file.name development
file.owner equivalent file.owner.name development
file.path match file.path development
file.size match file.size development
file.target_path equivalent file.symbolic_link.target_path development
file.uid equivalent file.owner.id development
Gen AI Fields
gen_ai.agent.description match gen_ai.agent.description development
gen_ai.agent.id match gen_ai.agent.id development
gen_ai.agent.name match gen_ai.agent.name development
gen_ai.operation.name match gen_ai.operation.name development
gen_ai.output.type match gen_ai.output.type development
gen_ai.request.choice.count match gen_ai.request.choice.count development
gen_ai.request.encoding_formats match gen_ai.request.encoding_formats development
gen_ai.request.frequency_penalty match gen_ai.request.frequency_penalty development
gen_ai.request.max_tokens match gen_ai.request.max_tokens development
gen_ai.request.model match gen_ai.request.model development
gen_ai.request.presence_penalty match gen_ai.request.presence_penalty development
gen_ai.request.seed match gen_ai.request.seed development
gen_ai.request.stop_sequences match gen_ai.request.stop_sequences development
gen_ai.request.temperature match gen_ai.request.temperature development
gen_ai.request.top_k match gen_ai.request.top_k development
gen_ai.request.top_p match gen_ai.request.top_p development
gen_ai.response.finish_reasons match gen_ai.response.finish_reasons development
gen_ai.response.id match gen_ai.response.id development
gen_ai.response.model match gen_ai.response.model development
gen_ai.system equivalent gen_ai.provider.name development
gen_ai.token.type match gen_ai.token.type development
gen_ai.tool.call.id match gen_ai.tool.call.id development
gen_ai.tool.name match gen_ai.tool.name development
gen_ai.tool.type match gen_ai.tool.type development
gen_ai.usage.input_tokens match gen_ai.usage.input_tokens development
gen_ai.usage.output_tokens match gen_ai.usage.output_tokens development
Geo Fields
geo.city_name equivalent geo.locality.name development
geo.continent_code equivalent geo.continent.code development
geo.country_iso_code equivalent geo.country.iso_code development
geo.location related geo.location.lat development
geo.location related geo.location.lon development
geo.postal_code match geo.postal_code development
geo.region_iso_code equivalent geo.region.iso_code development
Host Fields
host.architecture equivalent host.arch development
host.cpu.usage metric "&type=code" target="_blank" rel="noopener noreferrer">system.cpu.utilization development
host.disk.read.bytes metric "&type=code" target="_blank" rel="noopener noreferrer">system.disk.io development
host.disk.write.bytes metric "&type=code" target="_blank" rel="noopener noreferrer">system.disk.io development
host.id match host.id development
host.ip match host.ip development
host.mac match host.mac development
host.name match host.name development
host.network.egress.bytes metric "&type=code" target="_blank" rel="noopener noreferrer">system.network.io development
host.network.egress.packets metric "&type=code" target="_blank" rel="noopener noreferrer">system.network.packet.count development
host.network.ingress.bytes metric "&type=code" target="_blank" rel="noopener noreferrer">system.network.io development
host.network.ingress.packets metric "&type=code" target="_blank" rel="noopener noreferrer">system.network.packet.count development
host.type match host.type development
host.uptime metric "&type=code" target="_blank" rel="noopener noreferrer">system.uptime development
HTTP Fields
http.request.body.bytes equivalent http.request.body.size development
http.request.bytes equivalent http.request.size development
http.request.method equivalent http.request.method_original stable
http.request.method conflict http.request.methodNote: http.request.method in SemConv is the known, normalized, upper case value of the request method, other than the ECS' http.request.method that retains casing from the original event. stable
http.response.body.bytes equivalent http.response.body.size development
http.response.bytes equivalent http.response.size development
http.response.status_code match http.response.status_code stable
http.version related network.protocol.name stable
http.version related network.protocol.versionNote: In OTel SemConv, network.protocol.version specifies the HTTP version if the value of network.protocol.name is http. stable
Log Fields
log.file.path match log.file.path development
log.level otlp severity_text stable
Network Fields
network.protocol equivalent network.protocol.name stable
network.transport match network.transport stable
network.type match network.type stable
Operating System Fields
os.full equivalent os.description development
os.name match os.name development
os.type conflict os.typeNote: The expected values in ECS for os.type do not correspond with the values defined in semantic conventions! development
os.version match os.version development
Process Fields
process.args equivalent process.command_args development
process.args_count match process.args_count development
process.command_line match process.command_line development
process.executable equivalent process.executable.path development
process.real_user.id match process.real_user.id development
process.saved_user.id match process.saved_user.id development
process.user.id match process.user.id development
process.interactive match process.interactive development
process.real_user.name match process.real_user.name development
process.saved_user.name match process.saved_user.name development
process.user.name match process.user.name development
process.group_leader.pid match process.group_leader.pid development
process.pid match process.pid development
process.session_leader.pid match process.session_leader.pid development
process.title match process.title development
process.uptime metric "&type=code" target="_blank" rel="noopener noreferrer">process.uptime development
process.vpid match process.vpid development
process.working_directory match process.working_directory development
Related Fields
related.hash not-applicable Not applicable.
related.hosts not-applicable Not applicable.
related.ip not-applicable Not applicable.
related.user not-applicable Not applicable.
Server Fields
server.address match server.address stable
server.port match server.port stable
Service Fields
service.environment equivalent deployment.environment.name development
service.name match service.name stable
service.node.name equivalent service.instance.id development
service.version match service.version stable
Source Fields
source.address match source.address development
source.port match source.port development
TLS Fields
tls.cipher match tls.cipher development
tls.client.certificate match tls.client.certificate development
tls.client.certificate_chain match tls.client.certificate_chain development
tls.client.hash.md5 match tls.client.hash.md5 development
tls.client.hash.sha1 match tls.client.hash.sha1 development
tls.client.hash.sha256 match tls.client.hash.sha256 development
tls.client.issuer match tls.client.issuer development
tls.client.ja3 match tls.client.ja3 development
tls.client.not_after match tls.client.not_after development
tls.client.not_before match tls.client.not_before development
tls.client.subject match tls.client.subject development
tls.client.supported_ciphers match tls.client.supported_ciphers development
tls.curve match tls.curve development
tls.established match tls.established development
tls.next_protocol match tls.next_protocol development
tls.resumed match tls.resumed development
tls.server.certificate match tls.server.certificate development
tls.server.certificate_chain match tls.server.certificate_chain development
tls.server.hash.md5 match tls.server.hash.md5 development
tls.server.hash.sha1 match tls.server.hash.sha1 development
tls.server.hash.sha256 match tls.server.hash.sha256 development
tls.server.issuer match tls.server.issuer development
tls.server.ja3s match tls.server.ja3s development
tls.server.not_after match tls.server.not_after development
tls.server.not_before match tls.server.not_before development
tls.server.subject match tls.server.subject development
Tracing Fields
span.id otlp span_id stable
trace.id otlp trace_id stable
transaction.id not-applicable Not applicable.
URL Fields
url.domain match url.domain development
url.extension match url.extension development
url.fragment match url.fragment stable
url.full match url.full stable
url.original match url.original development
url.path match url.path stable
url.port match url.port development
url.query match url.query stable
url.registered_domain match url.registered_domain development
url.scheme match url.scheme stable
url.subdomain match url.subdomain development
url.top_level_domain match url.top_level_domain development
User Fields
user.email match user.email development
user.full_name match user.full_name development
user.hash match user.hash development
user.id match user.id development
user.name match user.name development
user.roles match user.roles development
User agent Fields
user_agent.name match user_agent.name development
user_agent.original match user_agent.original stable
user_agent.version match user_agent.version development