From 170f93d9ff4d1ab358804e92cd01c97f324d8608 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Mon, 29 Oct 2018 11:08:16 -0400 Subject: [PATCH 1/2] Tweak note about 'IDs' being keyword to also mention 'codes' --- README.md | 9 +++++---- docs/implementing.md | 9 +++++---- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 5302d84967..1d7c211d17 100644 --- a/README.md +++ b/README.md @@ -503,11 +503,12 @@ of a breaking change with these two widely used fields in Beats. Any future field that will be indexed for full text search in ECS will however follow the multi-field convention where `text` indexing is nested in the multi-field. -### IDs are keywords not integers +### IDs and codes are keywords, not integers -Despite the fact that IDs are often integers in various systems, this is not -always the case. Since we want to make it possible to map as many data sources -to ECS as possible, we default to using the `keyword` type for IDs. +Despite the fact that IDs and codes (e.g. error codes) are often integers, +this is not always the case. +Since we want to make it possible to map as many systems and data sources +to ECS as possible, we default to using the `keyword` type for IDs and codes. # FAQ diff --git a/docs/implementing.md b/docs/implementing.md index d1a006dd71..9ffba5620e 100644 --- a/docs/implementing.md +++ b/docs/implementing.md @@ -71,8 +71,9 @@ of a breaking change with these two widely used fields in Beats. Any future field that will be indexed for full text search in ECS will however follow the multi-field convention where `text` indexing is nested in the multi-field. -### IDs are keywords not integers +### IDs and codes are keywords, not integers -Despite the fact that IDs are often integers in various systems, this is not -always the case. Since we want to make it possible to map as many data sources -to ECS as possible, we default to using the `keyword` type for IDs. +Despite the fact that IDs and codes (e.g. error codes) are often integers, +this is not always the case. +Since we want to make it possible to map as many systems and data sources +to ECS as possible, we default to using the `keyword` type for IDs and codes. From 76232de8fd50bd83245155693443e1da982ccfb2 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Wed, 31 Oct 2018 16:21:17 -0400 Subject: [PATCH 2/2] Add some wording about some codes that can safely be ints --- README.md | 7 ++++++- docs/implementing.md | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 1d7c211d17..34f9d7cddc 100644 --- a/README.md +++ b/README.md @@ -503,13 +503,18 @@ of a breaking change with these two widely used fields in Beats. Any future field that will be indexed for full text search in ECS will however follow the multi-field convention where `text` indexing is nested in the multi-field. -### IDs and codes are keywords, not integers +### IDs and most codes are keywords, not integers Despite the fact that IDs and codes (e.g. error codes) are often integers, this is not always the case. Since we want to make it possible to map as many systems and data sources to ECS as possible, we default to using the `keyword` type for IDs and codes. +Some specific kinds of codes are always integers, like HTTP status codes. +If those have a specific corresponding specific field (as HTTP status does), +its type can safely be an integer type. +But generic field like `error.code` cannot have this guarantee, and are therefore `keyword`. + # FAQ ## What are the benefits of using ECS? diff --git a/docs/implementing.md b/docs/implementing.md index 9ffba5620e..7e96be4489 100644 --- a/docs/implementing.md +++ b/docs/implementing.md @@ -71,9 +71,14 @@ of a breaking change with these two widely used fields in Beats. Any future field that will be indexed for full text search in ECS will however follow the multi-field convention where `text` indexing is nested in the multi-field. -### IDs and codes are keywords, not integers +### IDs and most codes are keywords, not integers Despite the fact that IDs and codes (e.g. error codes) are often integers, this is not always the case. Since we want to make it possible to map as many systems and data sources to ECS as possible, we default to using the `keyword` type for IDs and codes. + +Some specific kinds of codes are always integers, like HTTP status codes. +If those have a specific corresponding specific field (as HTTP status does), +its type can safely be an integer type. +But generic field like `error.code` cannot have this guarantee, and are therefore `keyword`.