ECS is a standardized dictionary of log context keys for Elasticsearch. (E.g. the IP address is always called client.ip; the user agent is always called user_agent.original.) Using standard key names would solve several problems:
- Within the same Elasticsearch index, a given key name needs to consistently have the same type (string, int etc). If two different log events use the same key with different types, that will result in indexing errors or the field becoming unsearchable. (E.g. this is happening to the user field of many MediaWiki logs now.) Using ECS field names would avoid this for the most common fields.
- Opensearch dashboards are built from visualisation blocks; visualisations need hard-coded field names. So inconsistency in field names makes visualizations less reusable and Logstash dashboard maintenance more cumbersome.
- Consistent field names make it easier to create dashboards that display events across multiple sources.
- Refreshing field mappings is needed less often.
On the other hand, migrating to ECS would require updating tons of dashboards, and there is no easy way to automatically identify dashboards that will be affected.