It appears event.duration is not found in the index templates for the azure integrations which could lead to a mapping conflict:
Long is the preferred mapping in the other indices.

{
".ds-logs-azure.activitylogs-default-2022.03.23-000001" : {
"mappings" : {
"event.duration" : {
"full_name" : "event.duration",
"mapping" : {
"duration" : {
"type" : "keyword",
"ignore_above" : 1024
}
}
}
}
},

This is similar to: #2667