Stack traces ought to go into `error.stack_trace`, access log records should be flagged as such with `event.type: 'access'` https://www.elastic.co/guide/en/ecs/current/ecs-error.html#field-error-stack-trace https://www.elastic.co/guide/en/ecs/current/ecs-allowed-values-event-type.html#ecs-event-type-access