Hi,
While I was working with some conflicts in data views I found that for logs-system.security the error.code field is mapping as long.
According to the ECS documentation should be keyword (https://www.elastic.co/guide/en/ecs/current/ecs-error.html)

I think this is because in the component template logs-system.security@package there is not explicit mapping for error fields
Thanks a lot
Hi,

While I was working with some conflicts in data views I found that for logs-system.security the error.code field is mapping as long.
According to the ECS documentation should be keyword (https://www.elastic.co/guide/en/ecs/current/ecs-error.html)
I think this is because in the component template logs-system.security@package there is not explicit mapping for error fields
Thanks a lot