Type to search.

Elastic Common Schema (ECS) release notes

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Review the changes, fixes, and more in each version of ECS.

To check for security updates, go to Security announcements for the Elastic stack.

  • Add vulnerability.status field with allowed values open, fixed, reopened, unknown. #2662
  • Add host.tags field. #2674
  • Streamline RFC process from four stages (Strawperson, Draft, Candidate, Finished) to a single Proposal stage with target maturity. #2600
  • Fix GenAI integer fields to use long datatype per ECS conventions. #2646
  • Add alpha field maturity attribute, mirroring beta with mutual exclusion. #2599
  • Document field stability definitions (alpha, beta, GA) in design principles. #2599
  • Increase composable template total_fields.limit from 2000 to 2500. #2584
  • Remove the experimental/ build pipeline and unused cgroup.* fields; alpha and beta fields now live in schemas/. #2599
  • Add entity.attributes.*, entity.lifecycle.last_activity, and entity.relationships.* fields from RFC 0054. Introduce reusable entity_reference field set for shared relationship identifier keys. #2648
  • Added details for implementation of url.query to avoid ambiguity #2488
  • Added cloud and orchestrator as allowed values for entity.type. #2567
  • Allow entity fields at root level. #2567
  • Added entity.target for self-nesting. #2567
  • Added the target field to be nested under host #2571
  • Add device value to event.type #2524
  • Add new device fields #2530
  • Added entity fieldset as beta #2537
  • Add gen_ai fields to schema as beta. #2475
  • Allow Unicode characters in generated ECS yml files. #2478
  • Update semconv version used in file generation to v1.34.0 #2483
  • Add origin_referrer_url and origin_url fields, which indicate the origin information to the file, process and dll schemas #2441
  • Add thumbprint_sha256 to code_signature schema. #2452
  • Fix otel urls for fieldsets with underscores. #2486
  • Define base encoding of x509.serial_number. #2383
  • Restrict the encoding of x509.serial_number to base 16. #2398
  • Promote beta fields to GA. #2411
  • Add mapping between ECS and OpenTelemetry. #2415
  • Set synthetic_source_keep = none on fields that represent sets. #2422
  • Increase ignore_above value for url.query. #2424
  • Add origin_referrer_url and origin_url fields, which indicate the origin information to the file, process and dll schemas. #2441
  • Fix link rendering issues and usage of http in links. #2423
  • Fix link rendering for additional fields. #2458