Document the principal to user.name alias

elastic · Jan 16, 2019 · 1dc24da · 1dc24da
1 parent 370d098
commit 1dc24da
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/dev-tools/ecs-migration.yml b/dev-tools/ecs-migration.yml
@@ -288,14 +288,18 @@
   to: source.ip
   alias: true
 
-- from: elasticsearch.audit.uri
-  to: url.original
+- from: elasticsearch.audit.principal
+  to: user.name
   alias: true
 
 - from: elasticsearch.audit.request_body
   to: http.request.body.content
   alias: true
 
+- from: elasticsearch.audit.uri
+  to: url.original
+  alias: true
+
 ## IIS module
 
 - from: iis.access.server_ip