Describe the enhancement:
Describe a specific use case for the enhancement or feature:

We use firewall fileset of Filebeat Fortinet module.
We found that, unlike the firewall fileset in the fortinet module, the device ID was not set to observer.serial_number.
Therefore we need to set it manually like this in pipeline.yml.

​ - rename:
field: rsa.misc.hardware_id
target_field: observer.serial_number
ignore_missing: true

Could we improve this in the future version please?