Beef up the description of the log field set.

Author: Mathieu Martin

code/go/ecs/log.go

@@ -2099,7 +2099,9 @@ example: `1.1`
 [[ecs-log]]
 === Log Fields
 
-Fields which are specific to log events.
+Low level details specific to log events.
+
+`log.*` typically contains lower level details about the logging mechanism than `event.*`. For example, The Syslog transport details belongs under `log.*`, whereas the message payloads transmitted via Syslog will likely be parsed out into `event.*` or elsewhere in ECS.
 
 ==== Log Field Details
 

docs/field-details.asciidoc

@@ -52,7 +52,7 @@ all fields are defined.
 
 | <<ecs-http,HTTP>> | Fields describing an HTTP request.
 
-| <<ecs-log,Log>> | Fields which are specific to log events.
+| <<ecs-log,Log>> | Low level details specific to log events.
 
 | <<ecs-network,Network>> | Fields describing the communication path over which the event happened.
 

docs/fields.asciidoc

@@ -1583,7 +1583,12 @@
   - name: log
     title: Log
     group: 2
-    description: Fields which are specific to log events.
+    description: 'Low level details specific to log events.
+
+      `log.*` typically contains lower level details about the logging mechanism than
+      `event.*`. For example, The Syslog transport details belongs under `log.*`,
+      whereas the message payloads transmitted via Syslog will likely be parsed out
+      into `event.*` or elsewhere in ECS.'
     type: group
     fields:
     - name: level

generated/beats/fields.ecs.yml

@@ -2564,7 +2564,12 @@ http:
   title: HTTP
   type: group
 log:
-  description: Fields which are specific to log events.
+  description: 'Low level details specific to log events.
+
+    `log.*` typically contains lower level details about the logging mechanism than
+    `event.*`. For example, The Syslog transport details belongs under `log.*`, whereas
+    the message payloads transmitted via Syslog will likely be parsed out into `event.*`
+    or elsewhere in ECS.'
   fields:
     level:
       description: 'Original log level of the log event.
@@ -2644,7 +2649,7 @@ log:
   group: 2
   name: log
   prefix: log.
-  short: Fields which are specific to log events.
+  short: Low level details specific to log events.
   title: Log
   type: group
 network:

generated/ecs/ecs_nested.yml

@@ -1533,7 +1533,7 @@
     "type": "group"
   }, 
   "log": {
-    "description": "Fields which are specific to log events.\n", 
+    "description": "Low level details specific to log events.\n`log.*` typically contains lower level details about the logging mechanism than `event.*`. For example, The Syslog transport details belongs under `log.*`, whereas the message payloads transmitted via Syslog will likely be parsed out into `event.*` or elsewhere in ECS.\n", 
     "fields": {
       "log.level": {
         "description": "Original log level of the log event.\nSome examples are `warn`, `error`, `i`.", 

schema.json

@@ -2,8 +2,14 @@
 - name: log
   title: Log
   group: 2
+  short: Low level details specific to log events.
   description: >
-    Fields which are specific to log events.
+    Low level details specific to log events.
+
+    `log.*` typically contains lower level details about the logging mechanism
+    than `event.*`. For example, The Syslog transport details belongs under `log.*`,
+    whereas the message payloads transmitted via Syslog will likely be parsed out
+    into `event.*` or elsewhere in ECS.
   type: group
   fields:
 
@@ -42,7 +48,7 @@
       example: org.elasticsearch.bootstrap.Bootstrap
       short: Name of the logger.
       description: >
-        The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. 
+        The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name.
 
     - name: origin.file.name
       level: extended
@@ -60,12 +66,11 @@
       short: The line number of the file which originated the log event.
       description: >
         The line number of the file containing the source code which originated the log event.
- 
+
     - name: origin.function
       level: extended
       type: keyword
       example: init
       short: The function which originated the log event.
       description: >
         The name of the function or method which originated the log event.
-