• The current ECS version in the system integration is 8.0.0. Based on the comment here there are quite a few log.syslog.* ECS fields that are not supported in 8.0.0 for that reason these fields are declared explicitly.
• These additional syslog fields has been introduced in 8.2.0 release.

Next Steps

• Upgrade the ECS version to the latest.
• Remove the ECS field declarations for log.syslog fields and reference the fields from ECS.