Wired streams field naming

Field naming depends on the endpoint you use.

Data ingested into the logs.ecs endpoint is stored in the original ECS field names without being transformed. The fields remain as shown in the "ECS field" column in the field naming table.

Data ingested into the logs.otel endpoint is stored in OTel format. ECS fields are translated to their OTel semantic convention equivalents, so data is consistently structured and OTTL-expressible.

When data is ingested into a wired stream, it's automatically translated into this normalized format:

• Standard ECS documents are converted to OTel fields (message → body.text, log.level → severity_text, host.name → resource.attributes.host.name, and so on).
• Custom fields are stored under attributes.*.

To preserve backward-compatible querying, Streams creates ECS field name aliases on the ingested data, so queries using ECS field names continue to work even though the data is stored in OTel format.

Refer to the field naming table for ECS fields and corresponding OTel fields.

Data ingested into the /logs endpoint is stored and processed in a normalized OpenTelemetry (OTel)–compatible format. This format aligns ECS fields with OTel semantic conventions so all data is consistently structured and OTTL-expressible.

Data ingested into a wired stream is automatically translated into this normalized format:

• Streams converts standard ECS documents to OTel fields (message → body.text, log.level → severity_text, host.name → resource.attributes.host.name, and so on).
• Streams stores custom fields under attributes.*.

To preserve backward-compatible querying, Streams creates ECS field name aliases on the ingested data, so queries using ECS field names continue to work even though the data is stored in OTel format.

Refer to the field naming table for ECS fields and corresponding OTel fields.