From 4a49618ff70a199f155031fbb4e46c43779d2952 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Mon, 5 Oct 2020 10:40:32 -0400 Subject: [PATCH] Mention ECS Mapper in the main documentation (#987) (#1000) Co-authored-by: Dan Roscigno --- docs/converting.asciidoc | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/docs/converting.asciidoc b/docs/converting.asciidoc index 1db1fc7818..b4edd76e1d 100644 --- a/docs/converting.asciidoc +++ b/docs/converting.asciidoc @@ -44,3 +44,18 @@ Here's the recommended approach for converting an existing implementation to {ec . Set `ecs.version` to the version of the schema you are conforming to. This will allow you to upgrade your sources, pipelines and content (like dashboards) smoothly in the future. + +[float] +[[ecs-conv-spreasheet]] +==== Using a spreadsheet to plan your migration + +Using a spreadsheet to plan the migration from pre-existing source fields to ECS +is a common practice. It's a good way to address each of your fields methodically among colleagues. + +If the data source is either a structured log, or if you already have a pipeline +producing events with these non-ECS field names, the tool +https://github.com/elastic/ecs-mapper[ECS Mapper] may help you get started in performing all of these field renames. + +After exporting your mapping spreadsheet to CSV, ECS Mapper will convert your field mapping +to equivalent pipelines for Beats, Elasticsearch, and Logstash. Learn more at +https://github.com/elastic/ecs-mapper[ECS Mapper].