Elasticsearch Output Format

[zimage]

Elasticseach has defined what they call their Elastic Common Schema, or ECS, that they recommend developers use when they import data into an Elasticsearch database. They have an ECS for DNS queries and answers. I was wondering if DNSMonster puts the data into ECS format when exporting it to Elasticsearch. I browsed the code quickly but couldn't find an obvious answer.

[mosajjal]

I believe it's currently possible to achieve this using a long winded gotemplate format. Happy to eventually merge that into the Elastic output as an optional flag so people don't have to manually come up with the template. feel free to put it together and paste it here and it might end up becoming a PR.