Edit field mappingsedit

Ingest pipelines create fields in an Elasticsearch index, but don’t define the fields themselves. Instead, each field requires a defined data type or mapping.

Mappings are defined in the fields directory. Like ingest pipelines, mappings only apply to the parent data stream. The Apache integration has four different field definitions:

│   └───access
│   │   └───elasticsearch/ingest_pipeline
│   │   │      default.yml
│   │   └───fields
│   │          agent.yml 
│   │          base-fields.yml 
│   │          ecs.yml 
│   │          fields.yml 
│   └───error
│   └───status


base-fields.yml never changes and is required for all integrations

Defines the relevant ECS fields

Custom Apache access log fields ??