Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions rfcs/text/0002-rfc-environment.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **2 (candidate)** <!-- Update to reflect target stage -->
- Date: **2021-07-28** <!-- Update to reflect date of most recent stage advancement -->

> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema as **beta**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC. Beta fields will be evaluated for GA promotion under the field lifecycle process.

<!--
Stage 0: Provide a high level summary of the premise of these changes. Briefly describe the nature, purpose, and impact of the changes. ~2-5 sentences.
-->
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0003-object-field.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **0 (strawperson)** <!-- Update to reflect target stage -->
- Date: **2020-07-27** <!-- Update to reflect date of most recent stage advancement -->

> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process.

<!--
Stage 0: Provide a high level summary of the premise of these changes. Briefly describe the nature, purpose, and impact of the changes. ~2-5 sentences.
-->
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0004-session.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **0 (strawperson)** <!-- Update to reflect target stage -->
- Date: 7/30/2020 <!-- Update to reflect date of most recent stage advancement -->

> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process.

<!--
Stage 0: Provide a high level summary of the premise of these changes. Briefly describe the nature, purpose, and impact of the changes. ~2-5 sentences.
-->
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0006-host-identifiers.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **0 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2020-09-08** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0009-data_stream-fields.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **2 (candidate)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2021-04-19** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema as **beta**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC. Beta fields will be evaluated for GA promotion under the field lifecycle process.

When introducing the new indexing strategy for Elastic Agent which uses data streams, we found that adding a few [constant_keyword](https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html#constant-keyword-field-type) fields corresponding to the central components in the new indexing strategy would be advantageous.


Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0011-sip-fields.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **1 (proposal)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2020-12-04** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0013-network-headers.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **0 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2021-02-05** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0015-create-file-elf.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@
- Stage: **2 (candidate)**
- Date: **2021-05-04**

> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema as **GA**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC.

Create the Executable Linkable Format (ELF) sub-field, of the `file` top-level fieldset. This document metadata can be used for malware research, as well as coding and other application development efforts.

## Fields
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0019-rpc-fieldset.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **0 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2021-04-14** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process.

We would like to introduce a new, top-level, `rpc` fieldset. This fieldset would be suitable for recording information pertaining to RPCs (Remote Procedure Calls),
such as the RPC system (e.g. gRPC, Thrift, Java RMI), service name, method name, and response status code.

Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0024-ticket-fields.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **0 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2021-05-11** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0026-database-object.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **0 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2021-06-01** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0027-faas-fields.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **2 (candidate)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2021-09-14** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema. The `faas.*` fields are **GA**. The `service.origin` and `service.target` reuse entries remain **beta**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC. Beta fields will be evaluated for GA promotion under the field lifecycle process.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0028-cgroups.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **1 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2021-11-05** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The experimental `cgroup.*` fields proposed in this RFC have been removed from the repository. Analysis found zero adoption: no integration imports these fields, Metricbeat handles cgroup v1/v2 differences internally via its own `system.process.cgroup.*` namespace (~80+ fields), and the ECS-level abstraction for container resource metrics already exists as `container.cpu.usage` and `container.memory.usage` (GA). The multi-stage RFC process has been retired in favor of the single-stage Proposal process. If there is renewed interest in ECS-level cgroup fields, a new proposal can be submitted under the current process.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0029-enforce-single-value-fields.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@
- Stage: **0 (strawperson)**
- Date: **2021/11/24**

> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process.

Most fields only hold single values but this is only partially documented and not formally enforced by elasticsearch mappings.
Elasticsearch is proposing some [changes to field mappings to allow arrays to be rejected](https://github.com/elastic/elasticsearch/issues/80825).
If ECS uses the new `allow_multiple_values:false` setting on single valued fields this would:
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0032-definition-of-ecs-compliance.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **2 (candidate)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2022-05-16** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** This RFC proposed compliance definitions, not schema field changes. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. Compliance guidance will be revisited as part of the updated process documentation.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0033-new-cloud-fields.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **0 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2022-07-22** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0034-device-fields.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **2 (candidate)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2022-08-16** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema as **beta**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC. Beta fields will be evaluated for GA promotion under the field lifecycle process.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0035-tty-output.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **2 (candidate)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2022/08/16** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema as **GA**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0036-authentication-fields.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@
Stage: 0
Date: 2022-12-16

> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process.

This RFC will provide normalization for fields related to authentication fields to assure that they are retained primarily in ECS core and in any extended fieldset when needed. These fields are important to normalize into ECS fields in order to maximize effectiveness of cross log utilization.

## Fields
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0037-host-metrics.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **0 (strawman)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2023-03-01** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** A subset of the proposed fields (`host.network.ingress.bytes`, `host.network.egress.bytes`) were independently added to the ECS schema as **GA** through OTel alignment work. The remaining proposed fields (cpu, memory, load, filesystem) were never merged. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in the remaining fields, a new proposal can be submitted under the current process.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0038-event-kind-asset.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **2 (Candidate)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2023-03-31** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema as **GA**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0039-tsdb-dimensions.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **0 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2023-04-11** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0041-asset-integration.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **0 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2023-07-07** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0042-risk-score-extensions.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
- Stage: **0 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Date: **2023-07-13** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process.

<!--
As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
Feel free to remove these comments as you go along.
Expand Down
2 changes: 2 additions & 0 deletions rfcs/text/0043-risk-input-fields.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@
- Stage: **0 (strawperson)**
- Date: **2023-09-22** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process.

### Summary
This RFC aims to add a few general fields that, when defined on a document, will allow that document containing them to be consumed by Kibana's Risk Engine for the purposes of entity analytics.

Expand Down
Loading
Loading