From 724f24366cfda935e272647361be4de0e600a202 Mon Sep 17 00:00:00 2001
From: Mathieu Martin <mathieu.martin@elastic.co>
Date: Thu, 3 Jan 2019 16:22:20 -0500
Subject: [PATCH] Add two migrated fields to ecs-migration from #9645.

Notes:

- Can't be aliased since `body` is moving to `body.content`.
- Currently only affects Packetbeat, so it's been listed only there,
even if these are ECS field defs.
- This will affect the ES Filebeat module logs as well. A note as been
added to #9293, so it doesn't get forgotten.
---
 dev-tools/ecs-migration.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/dev-tools/ecs-migration.yml b/dev-tools/ecs-migration.yml
index 1355d8c5525..7938ee1b97c 100644
--- a/dev-tools/ecs-migration.yml
+++ b/dev-tools/ecs-migration.yml
@@ -587,6 +587,7 @@
   to: http.version
   alias: true
 
+
 # Auditbeat
 
 ## From Auditbeat's auditd module.
@@ -594,6 +595,20 @@
   to: source.domain
   alias: true
 
+
+# Packetbeat
+
+- from: http.request.body
+  to: http.request.body.content
+  alias6: false
+  alias: false
+
+- from: http.response.body
+  to: http.response.body.content
+  alias6: false
+  alias: false
+
+
 # Metricbeat
 
 ## Metricbeat base fields