# What version of Zeek is going to map to ECS ?

**URL:** <https://community.zeek.org/t/what-version-of-zeek-is-going-to-map-to-ecs/6185>\
**Category:** Zeek\
**Created:** [July 16, 2020, 11:21pm UTC](https://community.zeek.org/t/what-version-of-zeek-is-going-to-map-to-ecs/6185 "2020-07-16T23:21:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![SecOpsDirector](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@SecOpsDirector](https://community.zeek.org/u/SecOpsDirector)\
**Post date:** [July 16, 2020, 11:21pm UTC](https://community.zeek.org/t/what-version-of-zeek-is-going-to-map-to-ecs/6185/1 "2020-07-16T23:21:02Z")

</div>

Just curious what version of Zeek is going to have the ECS mapping ?

Thank you,

---

<div class="post-metadata">

**Author:** ![ericooi](https://avatars.discourse-cdn.com/v4/letter/e/ecae2f/32.png) [@ericooi](https://community.zeek.org/u/ericooi)\
**Post date:** [July 17, 2020, 2:35am UTC](https://community.zeek.org/t/what-version-of-zeek-is-going-to-map-to-ecs/6185/2 "2020-07-17T02:35:37Z")

</div>

Hi Don,

Assuming you’re using Filebeat’s Zeek module, it looks like ECS mapping is supported as of Zeek 2.6.1 ([https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-zeek.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-zeek.html)). This Github PR ([https://github.com/elastic/beats/pull/17738](https://github.com/elastic/beats/pull/17738)) references an update to the Zeek module to support ECS 1.5 (latest).

I have Zeek 3.1.4 sending logs to Elasticsearch 7.8 and can confirm that fields appear to be mapped properly.

Hope that helps!  
Eric  
[ericooi.com](http://ericooi.com)

---

<div class="post-metadata">

**Author:** ![Steve\_Smoot](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@Steve\_Smoot](https://community.zeek.org/u/Steve_Smoot)\
**Post date:** [July 17, 2020, 4:17am UTC](https://community.zeek.org/t/what-version-of-zeek-is-going-to-map-to-ecs/6185/3 "2020-07-17T04:17:41Z")

</div>

If you have other avenues in mind, see also:  
[https://github.com/corelight/ecs-mapping](https://github.com/corelight/ecs-mapping)

-s

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/what-version-of-zeek-is-going-to-map-to-ecs/6185/4 "2022-05-06T15:47:22Z")

</div>

Closed on May 6, 2022, 3:47pm UTC