From dd626361c27e5c72712eac5da1e27d26bd454e78 Mon Sep 17 00:00:00 2001 From: Dan Roscigno Date: Wed, 30 Sep 2020 13:29:57 -0400 Subject: [PATCH 1/2] Add ECS Mapper --- docs/converting.asciidoc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/converting.asciidoc b/docs/converting.asciidoc index 1db1fc7818..5e571e94ac 100644 --- a/docs/converting.asciidoc +++ b/docs/converting.asciidoc @@ -44,3 +44,5 @@ Here's the recommended approach for converting an existing implementation to {ec . Set `ecs.version` to the version of the schema you are conforming to. This will allow you to upgrade your sources, pipelines and content (like dashboards) smoothly in the future. + +The tool https://github.com/elastic/ecs-mapper[ECS Mapper] turns a field mapping from a CSV to an equivalent pipeline for Beats, Elasticsearch, and Logstash. From 5a107705e2245f48e923e941e94aa9c5491c8012 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Mon, 5 Oct 2020 10:11:00 -0400 Subject: [PATCH 2/2] Flesh out the ECS Mapper primer --- docs/converting.asciidoc | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/docs/converting.asciidoc b/docs/converting.asciidoc index 5e571e94ac..b4edd76e1d 100644 --- a/docs/converting.asciidoc +++ b/docs/converting.asciidoc @@ -45,4 +45,17 @@ Here's the recommended approach for converting an existing implementation to {ec allow you to upgrade your sources, pipelines and content (like dashboards) smoothly in the future. -The tool https://github.com/elastic/ecs-mapper[ECS Mapper] turns a field mapping from a CSV to an equivalent pipeline for Beats, Elasticsearch, and Logstash. +[float] +[[ecs-conv-spreasheet]] +==== Using a spreadsheet to plan your migration + +Using a spreadsheet to plan the migration from pre-existing source fields to ECS +is a common practice. It's a good way to address each of your fields methodically among colleagues. + +If the data source is either a structured log, or if you already have a pipeline +producing events with these non-ECS field names, the tool +https://github.com/elastic/ecs-mapper[ECS Mapper] may help you get started in performing all of these field renames. + +After exporting your mapping spreadsheet to CSV, ECS Mapper will convert your field mapping +to equivalent pipelines for Beats, Elasticsearch, and Logstash. Learn more at +https://github.com/elastic/ecs-mapper[ECS Mapper].