[RFC] 0017 Deprecation of log.original Stage 3 Proposal

[djptek]

• Have you signed the contributor license agreement? Y
• Have you followed the contributor guidelines? Y
• For proposing substantial changes or additions to the schema, have you reviewed the RFC process? Y
• If submitting code/script changes, have you verified all tests pass locally using make test? n/a
• If submitting schema/fields updates, have you generated new artifacts by running make and committed those changes? n/a
• Is your pull request against master? Unless there is a good reason otherwise, we prefer pull requests against master and will backport as needed. Y
• Have you added an entry to the CHANGELOG.next.md? TBC

[kgeller]

LGTM

[ebeahan]

A thought I had while reviewing:

We will want to update the log.original field description indicating the field's deprecation and upcoming removal from ECS.

[djptek]

We will want to update the log.original field description indicating the field's deprecation and upcoming removal from ECS.

This is referenced at L17 in the RFC and proposed change is here: https:/djptek/ecs/blob/rfc_0017_stage_3/rfcs/text/0017/event.yml

[djptek]

@elasticmachine run elasticsearch-ci/docs

[ebeahan]

LGTM 👍