[0] parsing field value failed: field "event.type"'s value "authentication" is not one of the allowed values (access, admin, allowed, change, connection, creation, deletion, denied, end, error, group, indicator, info, installation, protocol, start, user)

"authentication" => "access"?

Part of #3016.