Naming guidelines for indices, fields, roles, etc.?

General Feedback
1

are there any best practices, guidelines, etc. on how to name things? as we all know, naming things is hard :slight_smile:

namely i’m looking for advise on how to name indices and fields therein as well as security-related things (roles, etc.), but also anything else you’ll have to give a name to in elasticsearch/opensearch.
do you use snake_case? camelCase? WeirdCamelCase? dot.notation? minus-notation? alllowercasenoseparation, SCREAMING, ASuper_weird.Combination-Of_ITALL (hey, it’s already monday, but i didn’t have my fun on friday, ok? :rofl:)?
do you use singular or plural (e.g. do you call an index containing countries country or countries)?

do you prefix global things (indices, roles, etc.) since there’s no tenant-functionality in opensearch (not talking about kibana / opensearch dashboards)? e.g. acme-someindex instead of just someindex?

1 Like
2

Have a look at the ecs Elastic Common Schema (ECS) Reference [8.4] | Elastic that should give you a start and hopefully cover all of your fields.

1 Like
3

thanks a lot, @tony! i ignored ECS so far because it is about time series / events which my data isn’t, so a lot of it doesn’t apply to me. i now had a look at it and saw that the naming guideline for fields (but not indices & other things) for ECS can be found here: Guidelines and Best Practices | Elastic Common Schema (ECS) Reference [8.4] | Elastic

this already helps, but it doesn’t give me an answer for indices, roles, etc. and for prefixing things (which isn’t relevant in an index because whoever defines it controls it fully).

1 Like
4

We find that ECS has a ton of holes, even for the datasets that it supposedly supports. However I would agree most of the field naming conventions. The exception is abbreviations. ECS suggests avoiding them. However this results in unnecessarily long names with little added clarity. For example, there probably aren’t many people confused by src.ip and dst.ip, yet in ECS they are source.ip and (worse) destination.ip. It isn’t just the extra typing. It also wastes screen space in the UI.

5

so what do you recommend?

the main advantage i see about ECS is that anyone can create visualizations and dashboards and i can use it with my data set and index without having to rebuild it