From 87ed699352d097acd4bf034441ace8b0064d541f Mon Sep 17 00:00:00 2001 From: Joe Gallo Date: Thu, 12 Jun 2025 11:02:48 -0400 Subject: [PATCH] Fix the rendering of a table in the `normalize_for_stream` docs (#129345) --- docs/reference/enrich-processor/normalize-for-stream.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/reference/enrich-processor/normalize-for-stream.md b/docs/reference/enrich-processor/normalize-for-stream.md index 0deb8b5d8abc..361638679bd6 100644 --- a/docs/reference/enrich-processor/normalize-for-stream.md +++ b/docs/reference/enrich-processor/normalize-for-stream.md @@ -40,6 +40,7 @@ If the document is not OpenTelemetry-compliant, the processor normalizes it as f | `trace.id` | `trace_id` | | `message` | `body.text` | | `log.level` | `severity_text` | + The processor first looks for the nested form of the ECS field and if such does not exist, it looks for a top-level field with the dotted field name. * Other specific ECS fields that describe resources and have corresponding counterparts in the OpenTelemetry Semantic Conventions are moved to the `resource.attribtues` map. Fields that are considered resource attributes are such that conform to the following conditions: * They are ECS fields that have corresponding counterparts (either with