diff --git a/dev-tools/ecs-migration.yml b/dev-tools/ecs-migration.yml
index 41243ad1a557..f95542a780d8 100644
--- a/dev-tools/ecs-migration.yml
+++ b/dev-tools/ecs-migration.yml
@@ -454,21 +454,21 @@
   to: message
   alias: true
 - from: icinga.debug.severity
-  to: message
+  to: log.level
   alias: true
 
 - from: icinga.main.message
   to: message
   alias: true
 - from: icinga.main.severity
-  to: message
+  to: log.level
   alias: true
 
 - from: icinga.startup.message
   to: message
   alias: true
 - from: icinga.startup.severity
-  to: message
+  to: log.level
   alias: true
 
 # Auditbeat