elastic_ecs translator: Add omission for network-traffic:src_ref.type and network-traffic:dst_ref.type, make values goes to correct field based on type.

[Limeboy0603]

This issue is half bug and half feature request.

The Issue I found

So I have this query exported from MISP:

[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '46.151.182.229' AND network-traffic:dst_port = '1999']

When passing it to stix-shifter to convert it into Elasticsearch Query, I got this:

$ stix-shifter translate elastic_ecs query {} "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '46.151.182.229' AND network-traffic:dst_port = '1999']" {} | jq '.queries[0]' -r
 2026-06-05 18:51:02,244 stix_shifter_utils.modules.base.stix_translation.base_query_translator WARNING  The following STIX fields are not supported : {'network-traffic:dst_ref.type'} with dialect default. The request will ignore those fields. This can result in results that do not match the request.
 2026-06-05 18:51:02,244 stix_shifter.stix_translation.stix_translation ERROR    Caught exception: Unable to map the following STIX objects and properties: ['network-traffic:dst_ref.type'] to data source fields <class 'stix_shifter_utils.stix_translation.src.utils.exceptions.DataMappingException'>
 2026-06-05 18:51:02,322 stix_shifter_utils.stix_translation.stix_translation_error_mapper ERROR    received exception => DataMappingException: Unable to map the following STIX objects and properties: ['network-traffic:dst_ref.type'] to data source fields
null

Which I think just doesn't make any sense when clearly network-traffic:dst_ref.type can be ignored.

$ stix-shifter translate elastic_ecs query {} "[network-traffic:dst_ref.value = '46.151.182.229' AND network-traffic:dst_port = '1999']" {} | jq '.queries[0]' -r
 2026-06-05 18:51:14,158 stix_shifter_modules.elastic_ecs.stix_translation.query_translator INFO     Converting STIX2 Pattern to data source query
((destination.port : "1999" OR server.port : "1999" OR destination.nat.port : "1999" OR server.nat.port : "1999") AND (destination.ip : "46.151.182.229" OR server.ip : "46.151.182.229")) AND (@timestamp:["2026-06-05T10:46:14.160Z" TO "2026-06-05T10:51:14.160Z"])

The Proposal

I would like to request that network-traffic:src_ref.type and network-traffic:dst_ref.type to be omitted in the translation since both accepts the following only:

ipv4-addr, ipv6-addr, mac-addr, domain-name

Additionally, add conversion for network-traffic:src_ref and network-traffic:dst_ref to have it's value mapped to the appropriate ECS field based on it's type: (source/destination).(ip/mac/domain)