ECS version update

[faljabi]

When logging via winston I noticed that the ecs version is 1.6.0. Is this maintained to catch up with ECS versions 8.x?

[rom1vtle]

Today, do have a solution to resolve this problem ? or alternative code ?
I got the same probleme

[trentm]

Note that (per https://www.elastic.co/guide/en/ecs/current/ecs-ecs.html#field-ecs-version) the ecs.version field shouldn't itself be a cause of compatibility concerns. Are there particular compatibility issues with some fields that you are hitting?

The ECS logging formatters from this repo don't touch on that many fields in ECS, so it is possible (even likely) that there won't be any breakage when moving the ecs.version value forward.

I'll keep this issue open until we've updating the ecs.version value emitted by these loggers.

(Note to self: I'll need to work forward through the ECS versions starting from https://github.com/elastic/ecs/blob/main/CHANGELOG.md#160 to see if there are any adjustments needed.)

[trentm]

The relevant ECS field namespaces for these ecs-logging-nodejs libs are:

• log - https://www.elastic.co/guide/en/ecs/current/ecs-log.html
• ecs - https://www.elastic.co/guide/en/ecs/current/ecs-ecs.html
• tracing - https://www.elastic.co/guide/en/ecs/current/ecs-tracing.html
• error - https://www.elastic.co/guide/en/ecs/current/ecs-error.html
• client - https://www.elastic.co/guide/en/ecs/current/ecs-client.html
• http - https://www.elastic.co/guide/en/ecs/current/ecs-http.html
• url - https://www.elastic.co/guide/en/ecs/current/ecs-url.html
• event? Just event.dataset.
• host? Only for host.hostname used for Pino.
• process? Possibly relevant for Winston exception log record conversion, but not being used now.
• os? Possibly relevant for Winston exception log record conversion, but not being used now.

working through the ECS changelog

Pulling out all possibly relevant references in https://github.com/elastic/ecs/blob/main/CHANGELOG.md from 1.6.0 to the current latest (8.10.0):

1.7.0

• http.[request|response].mime_type #944
• Added the field .subdomain under client, destination, server, source and url, to match its presence at dns.question.subdomain. #981

1.8.0

Added os.type. #1111

1.9.0

Added http.request.id. #1208

8.0.0

• Remove deprecation notice on http.request.method. #1443

8.7.0

• description for host.name definition updated to encourage use of FDQN #2122

summary

• log - No relevant changes.
• ecs - No changes.
  • We'll bump ecs.version to "8.10.0".
• tracing - No changes.
• error - No changes.
• client - No relevant changes.
• http
  • http.[request|response].mime_type added in 1.7.0, but not considering
    adding this. It must be determined from response content, not a header.
  • http.request.id added in 1.9.0. Consider adding a possible req.id
    to http.request.id instead of to event.id. Note that req.id is not
    part of the http.IncomingMessage
    interface. Need to trawl through the various web frameworks to come up
    with any typical interface for a request id.
  • http.request.method guidance was changed in 8.0.0 to retain the origin casing.
• url - No relevant changes.
• event? Just event.dataset. - No change.
• host? Only for host.hostname used for Pino. - No change.