diff --git a/README.md b/README.md index 5302d84967..34f9d7cddc 100644 --- a/README.md +++ b/README.md @@ -503,11 +503,17 @@ of a breaking change with these two widely used fields in Beats. Any future field that will be indexed for full text search in ECS will however follow the multi-field convention where `text` indexing is nested in the multi-field. -### IDs are keywords not integers +### IDs and most codes are keywords, not integers -Despite the fact that IDs are often integers in various systems, this is not -always the case. Since we want to make it possible to map as many data sources -to ECS as possible, we default to using the `keyword` type for IDs. +Despite the fact that IDs and codes (e.g. error codes) are often integers, +this is not always the case. +Since we want to make it possible to map as many systems and data sources +to ECS as possible, we default to using the `keyword` type for IDs and codes. + +Some specific kinds of codes are always integers, like HTTP status codes. +If those have a specific corresponding specific field (as HTTP status does), +its type can safely be an integer type. +But generic field like `error.code` cannot have this guarantee, and are therefore `keyword`. # FAQ diff --git a/docs/implementing.md b/docs/implementing.md index d1a006dd71..7e96be4489 100644 --- a/docs/implementing.md +++ b/docs/implementing.md @@ -71,8 +71,14 @@ of a breaking change with these two widely used fields in Beats. Any future field that will be indexed for full text search in ECS will however follow the multi-field convention where `text` indexing is nested in the multi-field. -### IDs are keywords not integers +### IDs and most codes are keywords, not integers -Despite the fact that IDs are often integers in various systems, this is not -always the case. Since we want to make it possible to map as many data sources -to ECS as possible, we default to using the `keyword` type for IDs. +Despite the fact that IDs and codes (e.g. error codes) are often integers, +this is not always the case. +Since we want to make it possible to map as many systems and data sources +to ECS as possible, we default to using the `keyword` type for IDs and codes. + +Some specific kinds of codes are always integers, like HTTP status codes. +If those have a specific corresponding specific field (as HTTP status does), +its type can safely be an integer type. +But generic field like `error.code` cannot have this guarantee, and are therefore `keyword`.