Schema Changes

Added

• Add entity.attributes.*, entity.lifecycle.last_activity, and entity.relationships.* fields from RFC 0054. Introduce reusable entity_reference field set for shared relationship identifier keys. #2598

Tooling and Artifact Changes

Added

• Add alpha field maturity attribute, mirroring beta with mutual exclusion. #2599
• Document field stability definitions (alpha, beta, GA) in design principles. #2599

Improvements

• Increase composable template total_fields.limit from 2500 to 3000. #2598
• Increase composable template total_fields.limit from 2000 to 2500. #2584 (superseded by #2598)
• Remove the experimental/ build pipeline and unused cgroup.* fields; alpha and beta fields now live in schemas/. #2599

Tooling and Artifact Changes

Added

• Add alpha field maturity attribute, mirroring beta with mutual exclusion. #2599
• Document field stability definitions (alpha, beta, GA) in design principles. #2599

Improvements

• Increase composable template total_fields.limit from 2000 to 2500. #2584
• Remove the experimental/ build pipeline and unused cgroup.* fields; alpha and beta fields now live in schemas/. #2599

Schema Changes

Added

• Added cloud and orchestrator as allowed values for entity.type. #2567
• Allow entity fields at root level. #2567
• Added entity.target for self-nesting. #2567
• Added the target field to be nested under host #2571

Improvements

• Added details for implementation of url.query to avoid ambiguity #2488

Schema Changes

Added

• Added cloud and orchestrator as allowed values for entity.type. #2567
• Allow entity fields at root level. #2567
• Added entity.target for self-nesting. #2567
• Added the target field to be nested under host #2571

Improvements

• Added details for implementation of url.query to avoid ambiguity #2488

Schema Changes

Added

• Add device value to event.type #2524
• Add new device fields #2530
• Added entity fieldset as beta #2537

Schema Changes

Added

• Add device value to event.type #2524
• Add new device fields #2530
• Added entity fieldset as beta #2537

Schema Changes

Bugfixes

• Add origin_referrer_url and origin_url fields, which indicate the origin information to the file, process and dll schemas #2441
• Add thumbprint_sha256 to code_signature schema. #2452

Added

• Add gen_ai fields to schema as beta. #2475

Tooling and Artifact Changes

Bugfixes

• Fix otel urls for fieldsets with underscores. #2486

Improvements

• Allow Unicode characters in generated ECS yml files. #2478
• Update semconv version used in file generation to v1.34.0 #2483

Schema Changes

Breaking changes

• Remove deprecated fields from previous major release; process.pgid, service.node.role, and inherited users. #2410

Bugfixes

• Fix link rendering issues and usage of http in links. #2423
• Fix link rendering for additional fields. #2458

Added

• Add origin_referrer_url and origin_url fields, which indicate the origin information to the file, process and dll schemas. #2441

Improvements

• Define base encoding of x509.serial_number. #2383
• Restrict the encoding of x509.serial_number to base 16. #2398
• Promote beta fields to GA. #2411
• Set synthetic_source_keep = none on fields that represent sets. #2422
• Increase ignore_above value for url.query. #2424

Tooling and Artifact Changes

Added

• Add mapping between ECS and OpenTelemetry. #2415

Schema Changes

Breaking changes

• Remove deprecated fields from previous major release; process.pgid, service.node.role, and inherited users. #2410

Bugfixes

• Fix link rendering issues and usage of http in links. #2423

Added

• Add origin_referrer_url and origin_url fields, which indicate the origin information to the file, process and dll schemas. #2441

Improvements

• Increase ignore_above value for url.query. #2424
• Set synthetic_source_keep = none on fields that represent sets. #2422
• Promote beta fields to GA. #2411
• Restrict the encoding of x509.serial_number to base 16. #2398
• Define base encoding of x509.serial_number. #2383

Tooling and Artifact Changes

Added

• Add mapping between ECS and OpenTelemetry. #2415

Improvements

• Update data_stream.yml with top level type: group. #2414

Schema Changes

Bugfixes

• Fix link rendering issues and usage of http in links. #2423

Improvements

• Increase ignore_above value for url.query. #2424
• Set synthetic_source_keep = none on fields that represent sets. #2422