Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions CHANGELOG.next.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,14 @@

### Improvements

* Make the README.md a good starting point for contributors. Redirect to main
website for ECS documentation itself. #395

### Deprecated

* Move old `fields.yml` file from the root of the repo to `generated/legacy`. #386
* Replace the old all-in-one README.md. The official documentation is
now on the elastic.co website. #395

<!-- All empty sections:

Expand Down
31 changes: 4 additions & 27 deletions CONTRIBUTING.md
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,9 @@ You can contribute even if you are not an experienced Git user. You'll need a gi

The `fields.yml` files describe the Elastic Common Schema in a structured way. We can use these files to generate an Elasticsearch index template, a Kibana index pattern, or documentation output.

The file structure is similar to this:
The file structure is documented in [schemas/README.md](schemas).

It looks similar to this:

```
- name: agent
Expand Down Expand Up @@ -86,29 +88,4 @@ The `type` is the [Elasticsearch field type](https://www.elastic.co/guide/en/ela

## Guidelines for implementing ECS

* The document MUST have the `@timestamp` field.
* The [data type](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html)
defined for an ECS field MUST be used.
* It SHOULD have the field `ecs.version` to define which version of ECS it uses.
* As many fields as possible should be mapped to ECS.

### Writing fields

* All fields must be lower case
* Combine words using underscore
* No special characters except `_`

### Naming fields

* *Present tense.* Use present tense unless field describes historical information.
* *Singular or plural.* Use singular and plural names properly to reflect the field content. For example, use `requests_per_sec` rather than `request_per_sec`.
* *General to specific.* Organise the prefixes from general to specific to allow grouping fields into objects with a prefix like `host.*`.
* *Avoid repetition.* Avoid stuttering of words. If part of the field name is already in the prefix, do not repeat it. Example: `host.host_ip` should be `host.ip`.
* *Use prefixes.* Fields must be prefixed except for the base fields. For example all `host` fields are prefixed with `host.`. See `dot` notation in FAQ for more details.
* Do not use abbreviations. (A few exceptions such as `ip`, `os` ,`geo`, exist.)

### Implementation details

* Host can contain hostname and port (hostname:port)
* Hostname never contains a port number

Look at our [Guidelines and Best Practices](http://example.com) on the ECS documentation website.
50 changes: 24 additions & 26 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -40,10 +40,6 @@ clean:
codegen: gocodegen

# Build schema.csv from schema files.
.PHONY: csv
csv: ve
$(PYTHON) scripts/schemas.py

# Build the asciidoc book.
.PHONY: docs
docs:
Expand All @@ -52,16 +48,6 @@ docs:
fi
./build/docs/build_docs.pl --doc ./docs/index.asciidoc --chunk=1 $(OPEN_DOCS) -out ./build/html_docs

# Build the legacy fields.yml file.
.PHONY: fields_legacy
fields_legacy:
cat schemas/*.yml > fields.tmp.yml
sed -i.bak 's/^/ /g' fields.tmp.yml
sed -i.bak 's/---//g' fields.tmp.yml
cat generated/legacy/fields_header.yml > generated/legacy/fields.yml
cat fields.tmp.yml >> generated/legacy/fields.yml
rm -f fields.tmp.yml fields.tmp.yml.bak

# Format code and files in the repo.
.PHONY: fmt
fmt: ve
Expand All @@ -71,7 +57,11 @@ fmt: ve

# Alias to generate everything.
.PHONY: generate
generate: csv readme template fields_legacy codegen generator
generate: template legacy_fields legacy_csv legacy_use_cases codegen generator
# Generate the Use Cases
.PHONY: legacy_use_cases
legacy_use_cases:
$(PYTHON) scripts/use-cases.py --stdout=true >> /dev/null

# Run the new generator
.PHONY: generator
Expand All @@ -88,6 +78,25 @@ gocodegen:
-schema=../schemas \
-out=../code/go/ecs

.PHONY: legacy_csv
legacy_csv: ve
$(PYTHON) scripts/schemas.py

# Build the legacy fields.yml file.
.PHONY: legacy_fields
legacy_fields:
cat schemas/*.yml > fields.tmp.yml
sed -i.bak 's/^/ /g' fields.tmp.yml
sed -i.bak 's/---//g' fields.tmp.yml
cat generated/legacy/fields_header.yml > generated/legacy/fields.yml
cat fields.tmp.yml >> generated/legacy/fields.yml
rm -f fields.tmp.yml fields.tmp.yml.bak

# Generate the Use Cases
.PHONY: legacy_use_cases
legacy_use_cases:
$(PYTHON) scripts/use-cases.py --stdout=true >> /dev/null

# Check Makefile format.
.PHONY: makelint
makelint: SHELL:=/bin/bash
Expand All @@ -101,17 +110,6 @@ misspell:
go get github.com/client9/misspell/cmd/misspell
misspell README.md CONTRIBUTING.md

# Build README.md by concatenating various markdown snippets.
.PHONY: readme
readme:
cat docs/intro.md > README.md
$(PYTHON) scripts/schemas.py --stdout=true >> README.md
cat docs/use-cases-header.md >> README.md
$(PYTHON) scripts/use-cases.py --stdout=true >> README.md
cat docs/implementing.md >> README.md
cat docs/about.md >> README.md
cat docs/generated-files.md >> README.md

# Download and setup tooling dependencies.
.PHONY: setup
setup: ve
Expand Down
Loading