Ecs: Device or host address / location info

[willemdh]

Hello,

We need to add location info, such as street, number, code and city in separate fields. I'm not sure where this info should fit? Under hosts, device or maybe geoip..

Grtz

Willem

[ruflin]

Where are these fields coming from? Are they extracted from an ip address with a geo lookup?

[willemdh]

No they come from a custom jdbc sql query from our cmdb.

[ruflin]

I'm wonder if these field fit into ECS. The goal of the ECS fields is mainly to correlate and group events together. It seems an info like a specific street number is attached to a single document and less for correlation. What are the aggregations you will run for these fields?

Having said the above this doesn't mean you can add the fields on your end. You can use all the device.* fields and add for yourself device.address.street_nr etc. and add it to your schema.

[willemdh]

Well, we could do aggregations on the number of hosts per address.

Fyi, I only recently discovered ECS and imho it's a good concept. I just thought there should be some kind of default for all kinds of data. But as you imply, I'll add the data myself if you think it's not useful within ECS.

Thanks for the quick answer.

[ruflin]

So far I was mostly thinking of data centers / different cloud and users would aggregation on region: https://github.com/elastic/ecs/blob/master/schemas/cloud.yml#L28 But if you have a use case with computers in lots of different small locations this becomes probably harder.

I suggest we keep this open for others to chime in with similar use cases.

@willemdh Perhaps you can share your use case in more detail.

[willemdh]

@ruflin Well we have 250+ locations with different network devices, servers, clients etc. I'm working on visualising usage, coverage, trends etc for those locations. 99 % of our equipment and hosts are on premise, so the cloud object is not really useful for us.

[cstegm]

We have servers and other network devices at different locations and monitor their log files. Usecase: For certain hardware failures, you could forward the events directly to internal technicians. They will then drive to the address to replace/repair devices. For some buildings you also need site, section, level and room.

[ebeahan]

The current geo.* field set fills the gaps noted in the original issue description.

[willemdh]

@ebeahan Sry where can we find a place in 'geo.* field set' to put the street name and house number? So you are closing this why?

[ebeahan]

Hi, @willemdh. I closed the issue because:

• Since the original issue was opened, the geo.* field set has been expanded with additional fields. For example: city_name, country_name, and postal_code
• Address formats can vary widely. We could add a generic field to place the street number and address without splitting the address components, but I'm unsure how useful that would be.
• Custom fields are always welcome and can be adjusted to specific localities and use cases that are hard to account for in a common schema
• The discussion has been quiet for some time.

You're welcome to open a separate issue to continue a focused discussion around adding fields for street addresses.

[willemdh]

Thanks for your response @ebeahan but as I already created a ticket to add the street etc, more specific this one, Im going to leave creating another issue for someone else.