From dfb52cc0f08b7b9b6bf508563f47072b02f833c5 Mon Sep 17 00:00:00 2001
From: Andrew Kroh <andrew.kroh@elastic.co>
Date: Mon, 4 Feb 2019 17:32:55 -0500
Subject: [PATCH] Update ecs-migration.yml

---
 dev-tools/ecs-migration.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/dev-tools/ecs-migration.yml b/dev-tools/ecs-migration.yml
index df5d69a25a5d..5f7f578c7a55 100644
--- a/dev-tools/ecs-migration.yml
+++ b/dev-tools/ecs-migration.yml
@@ -1613,6 +1613,12 @@
   alias: true
   beat: auditbeat
 
+- from: event.type
+  to: auditd.message_type
+  alias: false
+  beat: auditbeat
+  comment: event.type is reserved for future use by ECS.
+
 # Metricbeat
 
 ## Metricbeat base fields