Following this PR which adds a check whether any indexed docs have an _ignored field - this would indicate a mapping problem:

Example output:

Error: error running package system tests: could not complete test run: found _ignored fields in data stream logs-cel.cel-ep

Also relevant elastic/elastic-package#1276

The following integration tests are failing with affected fields:

• ti_threatconnect: threat_connect.indicator.tags.data.description (cc @elastic/security-service-integrations )
• tenable_io: tenable_io.vulnerability.plugin.description vulnerability.description (cc @elastic/security-service-integrations )
• tanium: tanium.threat_response.other_parameters.log_details.payload, tanium.threat_response.other_parameters.original (cc @elastic/security-service-integrations )
• panw: panw.panos.after_change_detail (cc @elastic/sec-deployment-and-devices )
• m365_defender: m365_defender.incident.alert.recommended_actions (cc @elastic/security-service-integrations )
• fortinet_fortimanager: fortimanager.log.changes (cc @elastic/sec-deployment-and-devices)
• crowdstrike: crowdstrike.ConfigStateData, crowdstrike.FeatureVector, crowdstrike.OSVersionFileData, process.command_line (cc @elastic/security-service-integrations )

Steps:

• run the system tests to analyze the _ignored data and why is failing to index
• fix potential issues with the fields affected or ignore these usecases