I think this is where we should borrow/learn from ECS, and maybe @AlexanderWert can help us a lot.

I will give an example which shows how we end up with if we call it http.url:

A vendor is building an anti-virus software which records all the outgoing networking access, and for L7 actions, the software supports both FTP and HTTP.

The vendor would want to have a table which looks like:

| timestamp | user   | url.full              | blocked |
| --------- | ------ | --------------------- | ------- |
| T1        | reiley | http://wikipedia.org/ | no      |
| T2        | reiley | http://microsoft.com/ | no      |
| T3        | reiley | ftp://bad/malware     | yes     |

If we ask folks to use http.url and ftp.url, they will either end up with a sparse table that is hard to use, or they have to put things to different tables, or they will push for a new major version of semantic convention.

Should http.scheme be renamed to uri.scheme? #2489

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Should `http.scheme` be renamed to `uri.scheme`? #2489