Skip to content

system/auth: improve handling of user name and event outcome in auth dataset#4478

Merged
efd6 merged 7 commits intoelastic:mainfrom
efd6:4474-system.auth
Jan 19, 2023
Merged

system/auth: improve handling of user name and event outcome in auth dataset#4478
efd6 merged 7 commits intoelastic:mainfrom
efd6:4474-system.auth

Conversation

@efd6
Copy link
Copy Markdown
Contributor

@efd6 efd6 commented Oct 19, 2022

What does this PR do?

This enhances the user name processing and fixes event outcome processing for some cases of user creation and deletion, and user attribute change.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@efd6 efd6 force-pushed the 4474-system.auth branch from 94ac7e3 to 4337b68 Compare October 19, 2022 21:49
@efd6 efd6 self-assigned this Oct 19, 2022
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 19, 2022 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-01-19T20:45:00.961+0000

  • Duration: 15 min 53 sec

Test stats 🧪

Test Results
Failed 0
Passed 189
Skipped 0
Total 189

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@efd6 efd6 added the Team:Elastic-Agent-Data-Plane Agent Data Plane team [elastic/elastic-agent-data-plane] label Oct 19, 2022
@efd6 efd6 marked this pull request as ready for review October 19, 2022 22:21
@efd6 efd6 requested a review from a team as a code owner October 19, 2022 22:21
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 19, 2022

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 19, 2022

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@efd6
Copy link
Copy Markdown
Contributor Author

efd6 commented Oct 19, 2022 •
edited
Loading

There are extensive field definition duplications in the system package that result in doc generation instability and are the cause of the test failure. These will break building the package when package format v2 is used.

Details 
$ go run github.com/andrewkroh/go-examples/fields-yml-recommend@main -f=list packages/system/data_stream/*/fields/*
packages/system/data_stream/system/fields/base-fields.yml:10 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/base-fields.yml:10 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/base-fields.yml:10 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/base-fields.yml:10 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/base-fields.yml:10 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/base-fields.yml:11 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/base-fields.yml:10 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/base-fields.yml:10 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/base-fields.yml:10 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/base-fields.yml:10 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/base-fields.yml:11 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/base-fields.yml:10 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/base-fields.yml:10 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/base-fields.yml:10 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/base-fields.yml:10 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/base-fields.yml:11 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/base-fields.yml:10 - @timestamp : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:8 - cloud.account.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:16 - cloud.availability_zone : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:22 - cloud.instance.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:28 - cloud.instance.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:33 - cloud.machine.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:51 - cloud.project.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:39 - cloud.provider : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:45 - cloud.region : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:65 - container.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:70 - container.image.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:75 - container.labels : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:80 - container.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/base-fields.yml:4 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/base-fields.yml:5 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/base-fields.yml:4 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/base-fields.yml:4 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/base-fields.yml:5 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/base-fields.yml:4 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/base-fields.yml:4 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/base-fields.yml:4 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/base-fields.yml:4 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/base-fields.yml:4 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/base-fields.yml:5 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/base-fields.yml:4 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/base-fields.yml:4 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/base-fields.yml:4 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/base-fields.yml:4 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/base-fields.yml:4 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/base-fields.yml:4 - data_stream.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/base-fields.yml:7 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/base-fields.yml:7 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/base-fields.yml:7 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/base-fields.yml:7 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/base-fields.yml:7 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/base-fields.yml:8 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/base-fields.yml:7 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/base-fields.yml:7 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/base-fields.yml:7 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/base-fields.yml:7 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/base-fields.yml:7 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/base-fields.yml:8 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/base-fields.yml:7 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/base-fields.yml:7 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/base-fields.yml:7 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/base-fields.yml:8 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/base-fields.yml:7 - data_stream.namespace : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/base-fields.yml:1 - data_stream.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/base-fields.yml:17 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/base-fields.yml:17 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/base-fields.yml:18 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/base-fields.yml:17 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/base-fields.yml:17 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/base-fields.yml:17 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/base-fields.yml:14 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/base-fields.yml:17 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/base-fields.yml:17 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/base-fields.yml:17 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/base-fields.yml:17 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/base-fields.yml:17 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/base-fields.yml:14 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/base-fields.yml:17 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/base-fields.yml:17 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/base-fields.yml:17 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/base-fields.yml:17 - event.dataset : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/base-fields.yml:13 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/base-fields.yml:13 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/base-fields.yml:13 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/base-fields.yml:13 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/base-fields.yml:13 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/base-fields.yml:13 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/base-fields.yml:18 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/base-fields.yml:13 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/base-fields.yml:13 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/base-fields.yml:13 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/base-fields.yml:13 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/base-fields.yml:13 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/base-fields.yml:13 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/base-fields.yml:18 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/base-fields.yml:13 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/base-fields.yml:13 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/base-fields.yml:14 - event.module : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:93 - host.architecture : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/fields.yml:125 - host.disk.read.bytes : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:199 - host.disk.read.bytes : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:205 - host.disk.write.bytes : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/fields.yml:131 - host.disk.write.bytes : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:99 - host.domain : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:108 - host.hostname : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:115 - host.id : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:124 - host.ip : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:128 - host.mac : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:133 - host.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:140 - host.os.family : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:146 - host.os.kernel : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:152 - host.os.name : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:163 - host.os.platform : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:169 - host.os.version : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/application/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/diskio/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/cpu/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/uptime/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/filesystem/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/fsstat/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/load/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/memory/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/core/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/syslog/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/agent.yml:175 - host.type : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/auth/fields/ecs.yml:85 - source.geo.location : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/process_summary/fields/ecs.yml:29 - source.geo.location : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/network/fields/ecs.yml:29 - source.geo.location : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/socket_summary/fields/ecs.yml:29 - source.geo.location : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/security/fields/base-fields.yml:22 - tags : [Use 'external: ecs' to import the ECS definition.]
packages/system/data_stream/system/fields/winlog.yml:42 - winlog.event_data.BitlockerUserInputTime : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:90 - winlog.event_data.BitlockerUserInputTime : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:42 - winlog.event_data.BitlockerUserInputTime : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/ecs.yml:51 - process.name : [Duplicate field (7 times).]
packages/system/data_stream/network/fields/ecs.yml:17 - process.name : [Duplicate field (7 times).]
packages/system/data_stream/process/fields/ecs.yml:3 - process.name : [Duplicate field (7 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:17 - process.name : [Duplicate field (7 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:17 - process.name : [Duplicate field (7 times).]
packages/system/data_stream/syslog/fields/ecs.yml:53 - process.name : [Duplicate field (7 times).]
packages/system/data_stream/auth/fields/ecs.yml:63 - process.name : [Duplicate field (7 times).]
packages/system/data_stream/auth/fields/ecs.yml:85 - source.geo.location : [Duplicate field (5 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:29 - source.geo.location : [Duplicate field (5 times).]
packages/system/data_stream/security/fields/ecs.yml:89 - source.geo.location : [Duplicate field (5 times).]
packages/system/data_stream/network/fields/ecs.yml:29 - source.geo.location : [Duplicate field (5 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:29 - source.geo.location : [Duplicate field (5 times).]
packages/system/data_stream/process/fields/ecs.yml:13 - user : [Duplicate field (4 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:41 - user : [Duplicate field (4 times).]
packages/system/data_stream/network/fields/ecs.yml:41 - user : [Duplicate field (4 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:41 - user : [Duplicate field (4 times).]
packages/system/data_stream/application/fields/winlog.yml:210 - winlog.event_data.SubjectLogonId : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:418 - winlog.event_data.SubjectLogonId : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:210 - winlog.event_data.SubjectLogonId : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:232 - winlog.event_data.TerminalSessionId : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:232 - winlog.event_data.TerminalSessionId : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:450 - winlog.event_data.TerminalSessionId : [Duplicate field (3 times).]
packages/system/data_stream/core/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/diskio/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/cpu/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/auth/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/auth/fields/ecs.yml:47 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/load/fields/ecs.yml:7 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/uptime/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/process/fields/ecs.yml:23 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/network/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/memory/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/process/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/cpu/fields/ecs.yml:7 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/load/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/security/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/fsstat/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/fsstat/fields/ecs.yml:7 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/core/fields/ecs.yml:7 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/system/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/diskio/fields/ecs.yml:7 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/memory/fields/ecs.yml:7 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/syslog/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/application/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/syslog/fields/ecs.yml:37 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/process_summary/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/filesystem/fields/agent.yml:128 - host.mac : [Duplicate field (26 times).]
packages/system/data_stream/security/fields/winlog.yml:7 - winlog.api : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:7 - winlog.api : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:7 - winlog.api : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:74 - winlog.event_data.DriverNameLength : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:152 - winlog.event_data.DriverNameLength : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:74 - winlog.event_data.DriverNameLength : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:78 - winlog.event_data.EntryCount : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:158 - winlog.event_data.EntryCount : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:78 - winlog.event_data.EntryCount : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:142 - winlog.event_data.NominalFrequency : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:142 - winlog.event_data.NominalFrequency : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:266 - winlog.event_data.NominalFrequency : [Duplicate field (3 times).]
packages/system/data_stream/syslog/fields/ecs.yml:29 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/process/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/uptime/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/system/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/application/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/auth/fields/ecs.yml:37 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/cpu/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/auth/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/network/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/security/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/diskio/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/fsstat/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/filesystem/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/process_summary/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/load/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/core/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/syslog/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/memory/fields/agent.yml:99 - host.domain : [Duplicate field (19 times).]
packages/system/data_stream/core/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/auth/fields/ecs.yml:59 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/network/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/memory/fields/ecs.yml:19 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/process/fields/ecs.yml:35 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/process/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/auth/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/syslog/fields/ecs.yml:49 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/system/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/load/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/load/fields/ecs.yml:19 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/filesystem/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/core/fields/ecs.yml:19 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/security/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/diskio/fields/ecs.yml:21 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/diskio/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/process_summary/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/fsstat/fields/ecs.yml:19 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/syslog/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/uptime/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/fsstat/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/cpu/fields/ecs.yml:19 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/memory/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/cpu/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/application/fields/agent.yml:163 - host.os.platform : [Duplicate field (26 times).]
packages/system/data_stream/system/fields/winlog.yml:82 - winlog.event_data.FailureName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:164 - winlog.event_data.FailureName : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:82 - winlog.event_data.FailureName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:434 - winlog.event_data.TargetLogonId : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:224 - winlog.event_data.TargetLogonId : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:224 - winlog.event_data.TargetLogonId : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:216 - winlog.event_data.LogonType : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:118 - winlog.event_data.LogonType : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:118 - winlog.event_data.LogonType : [Duplicate field (3 times).]
packages/system/data_stream/syslog/fields/ecs.yml:51 - message : [Duplicate field (8 times).]
packages/system/data_stream/system/fields/ecs.yml:27 - message : [Duplicate field (8 times).]
packages/system/data_stream/auth/fields/ecs.yml:61 - message : [Duplicate field (8 times).]
packages/system/data_stream/network/fields/ecs.yml:3 - message : [Duplicate field (8 times).]
packages/system/data_stream/security/fields/ecs.yml:39 - message : [Duplicate field (8 times).]
packages/system/data_stream/application/fields/ecs.yml:11 - message : [Duplicate field (8 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:3 - message : [Duplicate field (8 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:3 - message : [Duplicate field (8 times).]
packages/system/data_stream/auth/fields/ecs.yml:79 - source.geo.continent_name : [Duplicate field (5 times).]
packages/system/data_stream/security/fields/ecs.yml:83 - source.geo.continent_name : [Duplicate field (5 times).]
packages/system/data_stream/network/fields/ecs.yml:25 - source.geo.continent_name : [Duplicate field (5 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:25 - source.geo.continent_name : [Duplicate field (5 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:25 - source.geo.continent_name : [Duplicate field (5 times).]
packages/system/data_stream/security/fields/winlog.yml:120 - winlog.event_data.CreationUtcTime : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:54 - winlog.event_data.CreationUtcTime : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:54 - winlog.event_data.CreationUtcTime : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:192 - winlog.event_data.IpAddress : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:100 - winlog.event_data.IpAddress : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:100 - winlog.event_data.IpAddress : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:230 - winlog.event_data.MinimumPerformancePercent : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:128 - winlog.event_data.MinimumPerformancePercent : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:128 - winlog.event_data.MinimumPerformancePercent : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:174 - winlog.event_data.PuaPolicyId : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:338 - winlog.event_data.PuaPolicyId : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:174 - winlog.event_data.PuaPolicyId : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:224 - winlog.event_data.MaximumPerformancePercent : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:122 - winlog.event_data.MaximumPerformancePercent : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:122 - winlog.event_data.MaximumPerformancePercent : [Duplicate field (3 times).]
packages/system/data_stream/process_summary/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:51 - cloud.project.id : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/winlog.yml:158 - winlog.event_data.PreviousTime : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:318 - winlog.event_data.PreviousTime : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:158 - winlog.event_data.PreviousTime : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:84 - winlog.event_data.FailureNameLength : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:84 - winlog.event_data.FailureNameLength : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:166 - winlog.event_data.FailureNameLength : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/ecs.yml:29 - group.id : [Duplicate field (5 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:7 - group.id : [Duplicate field (5 times).]
packages/system/data_stream/auth/fields/ecs.yml:31 - group.id : [Duplicate field (5 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:7 - group.id : [Duplicate field (5 times).]
packages/system/data_stream/network/fields/ecs.yml:7 - group.id : [Duplicate field (5 times).]
packages/system/data_stream/application/fields/winlog.yml:290 - winlog.opcode : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:532 - winlog.opcode : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:290 - winlog.opcode : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:58 - winlog.event_data.Detail : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:124 - winlog.event_data.Detail : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:58 - winlog.event_data.Detail : [Duplicate field (3 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:16 - cloud.availability_zone : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/winlog.yml:556 - winlog.task : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:314 - winlog.task : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:314 - winlog.task : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/ecs.yml:21 - event.provider : [Duplicate field (4 times).]
packages/system/data_stream/syslog/fields/ecs.yml:21 - event.provider : [Duplicate field (4 times).]
packages/system/data_stream/security/fields/ecs.yml:21 - event.provider : [Duplicate field (4 times).]
packages/system/data_stream/auth/fields/ecs.yml:25 - event.provider : [Duplicate field (4 times).]
packages/system/data_stream/application/fields/winlog.yml:140 - winlog.event_data.NewTime : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:140 - winlog.event_data.NewTime : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:260 - winlog.event_data.NewTime : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:238 - winlog.event_data.UserSid : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:470 - winlog.event_data.UserSid : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:238 - winlog.event_data.UserSid : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:284 - winlog.related_activity_id : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:526 - winlog.related_activity_id : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:284 - winlog.related_activity_id : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:88 - winlog.event_data.Binary : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:40 - winlog.event_data.Binary : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:40 - winlog.event_data.Binary : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:102 - winlog.event_data.IpPort : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:102 - winlog.event_data.IpPort : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:194 - winlog.event_data.IpPort : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/ecs.yml:69 - related.user : [Duplicate field (2 times).]
packages/system/data_stream/auth/fields/ecs.yml:71 - related.user : [Duplicate field (2 times).]
packages/system/data_stream/process/fields/ecs.yml:41 - ecs.version : [Duplicate field (4 times).]
packages/system/data_stream/syslog/fields/ecs.yml:3 - ecs.version : [Duplicate field (4 times).]
packages/system/data_stream/auth/fields/ecs.yml:3 - ecs.version : [Duplicate field (4 times).]
packages/system/data_stream/security/fields/ecs.yml:1 - ecs.version : [Duplicate field (4 times).]
packages/system/data_stream/security/fields/ecs.yml:45 - process.command_line : [Duplicate field (2 times).]
packages/system/data_stream/process/fields/ecs.yml:45 - process.command_line : [Duplicate field (2 times).]
packages/system/data_stream/application/fields/winlog.yml:208 - winlog.event_data.SubjectDomainName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:208 - winlog.event_data.SubjectDomainName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:416 - winlog.event_data.SubjectDomainName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:92 - winlog.event_data.BootMode : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:44 - winlog.event_data.BootMode : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:44 - winlog.event_data.BootMode : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:430 - winlog.event_data.TargetInfo : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:220 - winlog.event_data.TargetInfo : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:220 - winlog.event_data.TargetInfo : [Duplicate field (3 times).]
packages/system/data_stream/network/fields/ecs.yml:21 - source : [Duplicate field (3 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:21 - source : [Duplicate field (3 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:21 - source : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/ecs.yml:9 - event.created : [Duplicate field (5 times).]
packages/system/data_stream/auth/fields/ecs.yml:13 - event.created : [Duplicate field (5 times).]
packages/system/data_stream/system/fields/ecs.yml:9 - event.created : [Duplicate field (5 times).]
packages/system/data_stream/application/fields/ecs.yml:5 - event.created : [Duplicate field (5 times).]
packages/system/data_stream/syslog/fields/ecs.yml:11 - event.created : [Duplicate field (5 times).]
packages/system/data_stream/network/fields/base-fields.yml:13 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/system/fields/base-fields.yml:13 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/filesystem/fields/base-fields.yml:13 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/process_summary/fields/base-fields.yml:13 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/memory/fields/base-fields.yml:13 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/system/fields/ecs.yml:15 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/application/fields/base-fields.yml:13 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/syslog/fields/base-fields.yml:18 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/load/fields/base-fields.yml:13 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/fsstat/fields/base-fields.yml:13 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/process/fields/base-fields.yml:13 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/core/fields/base-fields.yml:13 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/diskio/fields/base-fields.yml:13 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/syslog/fields/ecs.yml:17 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/uptime/fields/base-fields.yml:13 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/auth/fields/base-fields.yml:18 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/socket_summary/fields/base-fields.yml:13 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/cpu/fields/base-fields.yml:13 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/auth/fields/ecs.yml:19 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/security/fields/ecs.yml:15 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/security/fields/base-fields.yml:14 - event.module : [Duplicate field (21 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:9 - group.name : [Duplicate field (5 times).]
packages/system/data_stream/security/fields/ecs.yml:31 - group.name : [Duplicate field (5 times).]
packages/system/data_stream/network/fields/ecs.yml:9 - group.name : [Duplicate field (5 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:9 - group.name : [Duplicate field (5 times).]
packages/system/data_stream/auth/fields/ecs.yml:33 - group.name : [Duplicate field (5 times).]
packages/system/data_stream/system/fields/winlog.yml:342 - winlog.user.domain : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:342 - winlog.user.domain : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:621 - winlog.user.domain : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:428 - winlog.event_data.TargetDomainName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:218 - winlog.event_data.TargetDomainName : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:218 - winlog.event_data.TargetDomainName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/ecs.yml:13 - event.kind : [Duplicate field (4 times).]
packages/system/data_stream/security/fields/ecs.yml:13 - event.kind : [Duplicate field (4 times).]
packages/system/data_stream/syslog/fields/ecs.yml:15 - event.kind : [Duplicate field (4 times).]
packages/system/data_stream/auth/fields/ecs.yml:17 - event.kind : [Duplicate field (4 times).]
packages/system/data_stream/diskio/fields/ecs.yml:25 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/application/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/diskio/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/cpu/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/process_summary/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/uptime/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/security/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/core/fields/ecs.yml:23 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/fsstat/fields/ecs.yml:23 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/filesystem/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/network/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/process/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/cpu/fields/ecs.yml:23 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/fsstat/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/load/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/memory/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/core/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/memory/fields/ecs.yml:23 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/syslog/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/auth/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/load/fields/ecs.yml:23 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/system/fields/agent.yml:175 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/process/fields/ecs.yml:39 - host.type : [Duplicate field (24 times).]
packages/system/data_stream/process/fields/ecs.yml:49 - service.type : [Duplicate field (2 times).]
packages/system/data_stream/security/fields/ecs.yml:73 - service.type : [Duplicate field (2 times).]
packages/system/data_stream/application/fields/winlog.yml:160 - winlog.event_data.PrivilegeList : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:322 - winlog.event_data.PrivilegeList : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:160 - winlog.event_data.PrivilegeList : [Duplicate field (3 times).]
packages/system/data_stream/auth/fields/ecs.yml:7 - event.action : [Duplicate field (4 times).]
packages/system/data_stream/security/fields/ecs.yml:3 - event.action : [Duplicate field (4 times).]
packages/system/data_stream/system/fields/ecs.yml:3 - event.action : [Duplicate field (4 times).]
packages/system/data_stream/syslog/fields/ecs.yml:5 - event.action : [Duplicate field (4 times).]
packages/system/data_stream/security/fields/winlog.yml:420 - winlog.event_data.SubjectUserName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:212 - winlog.event_data.SubjectUserName : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:212 - winlog.event_data.SubjectUserName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:476 - winlog.event_data.Workstation : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:242 - winlog.event_data.Workstation : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:242 - winlog.event_data.Workstation : [Duplicate field (3 times).]
packages/system/data_stream/core/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:45 - cloud.region : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/agent.yml:65 - container.id : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/application/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/system/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/memory/fields/ecs.yml:3 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/cpu/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/auth/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/security/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/syslog/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/diskio/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/fsstat/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/filesystem/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/load/fields/ecs.yml:3 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/process/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/syslog/fields/ecs.yml:27 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/uptime/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/cpu/fields/ecs.yml:3 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/process/fields/ecs.yml:19 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/auth/fields/ecs.yml:35 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/core/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/network/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/core/fields/ecs.yml:3 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/process_summary/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/fsstat/fields/ecs.yml:3 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/diskio/fields/ecs.yml:3 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/load/fields/agent.yml:93 - host.architecture : [Duplicate field (26 times).]
packages/system/data_stream/security/fields/winlog.yml:122 - winlog.event_data.Description : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:56 - winlog.event_data.Description : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:56 - winlog.event_data.Description : [Duplicate field (3 times).]
packages/system/data_stream/core/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/security/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/auth/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/filesystem/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/load/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/system/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/memory/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/application/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/syslog/fields/ecs.yml:33 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/cpu/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/diskio/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/process/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/auth/fields/ecs.yml:43 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/process_summary/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/uptime/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/fsstat/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/network/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/syslog/fields/agent.yml:115 - host.id : [Duplicate field (19 times).]
packages/system/data_stream/application/fields/winlog.yml:258 - winlog.event_data.param8 : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:494 - winlog.event_data.param8 : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:258 - winlog.event_data.param8 : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:90 - winlog.event_data.Group : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:174 - winlog.event_data.Group : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:90 - winlog.event_data.Group : [Duplicate field (3 times).]
packages/system/data_stream/cpu/fields/ecs.yml:9 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/load/fields/ecs.yml:9 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/security/fields/ecs.yml:33 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/memory/fields/ecs.yml:9 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/memory/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/process/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/process_summary/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/filesystem/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/application/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/process/fields/ecs.yml:25 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/syslog/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/syslog/fields/ecs.yml:39 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/cpu/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/core/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/system/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/diskio/fields/ecs.yml:11 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/security/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/fsstat/fields/ecs.yml:9 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/auth/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/uptime/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/fsstat/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/load/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/core/fields/ecs.yml:9 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/auth/fields/ecs.yml:49 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/diskio/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/network/fields/agent.yml:133 - host.name : [Duplicate field (27 times).]
packages/system/data_stream/security/fields/ecs.yml:85 - source.geo.country_iso_code : [Duplicate field (5 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:27 - source.geo.country_iso_code : [Duplicate field (5 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:27 - source.geo.country_iso_code : [Duplicate field (5 times).]
packages/system/data_stream/network/fields/ecs.yml:27 - source.geo.country_iso_code : [Duplicate field (5 times).]
packages/system/data_stream/auth/fields/ecs.yml:81 - source.geo.country_iso_code : [Duplicate field (5 times).]
packages/system/data_stream/system/fields/winlog.yml:92 - winlog.event_data.IdleImplementation : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:92 - winlog.event_data.IdleImplementation : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:184 - winlog.event_data.IdleImplementation : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:114 - winlog.event_data.LogonId : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:210 - winlog.event_data.LogonId : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:114 - winlog.event_data.LogonId : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:226 - winlog.event_data.TargetServerName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:436 - winlog.event_data.TargetServerName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:226 - winlog.event_data.TargetServerName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/ecs.yml:5 - event.category : [Duplicate field (4 times).]
packages/system/data_stream/syslog/fields/ecs.yml:7 - event.category : [Duplicate field (4 times).]
packages/system/data_stream/auth/fields/ecs.yml:9 - event.category : [Duplicate field (4 times).]
packages/system/data_stream/security/fields/ecs.yml:5 - event.category : [Duplicate field (4 times).]
packages/system/data_stream/system/fields/winlog.yml:86 - winlog.event_data.FileVersion : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:170 - winlog.event_data.FileVersion : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:86 - winlog.event_data.FileVersion : [Duplicate field (3 times).]
packages/system/data_stream/filesystem/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:75 - container.labels : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/network/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/fsstat/fields/ecs.yml:11 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/auth/fields/ecs.yml:51 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/application/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/process/fields/ecs.yml:27 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/system/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/security/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/memory/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/load/fields/ecs.yml:11 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/core/fields/ecs.yml:11 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/load/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/memory/fields/ecs.yml:11 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/diskio/fields/ecs.yml:13 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/core/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/cpu/fields/ecs.yml:11 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/process_summary/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/auth/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/process/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/syslog/fields/ecs.yml:41 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/fsstat/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/syslog/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/filesystem/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/uptime/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/diskio/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:140 - host.os.family : [Duplicate field (26 times).]
packages/system/data_stream/application/fields/winlog.yml:94 - winlog.event_data.IdleStateCount : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:94 - winlog.event_data.IdleStateCount : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:186 - winlog.event_data.IdleStateCount : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:148 - winlog.event_data.OldTime : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:296 - winlog.event_data.OldTime : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:148 - winlog.event_data.OldTime : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:202 - winlog.event_data.LastShutdownGood : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:108 - winlog.event_data.LastShutdownGood : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:108 - winlog.event_data.LastShutdownGood : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:240 - winlog.event_data.Version : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:240 - winlog.event_data.Version : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:474 - winlog.event_data.Version : [Duplicate field (3 times).]
packages/system/data_stream/auth/fields/ecs.yml:21 - event.original : [Duplicate field (4 times).]
packages/system/data_stream/security/fields/ecs.yml:17 - event.original : [Duplicate field (4 times).]
packages/system/data_stream/system/fields/ecs.yml:17 - event.original : [Duplicate field (4 times).]
packages/system/data_stream/application/fields/ecs.yml:9 - event.original : [Duplicate field (4 times).]
packages/system/data_stream/system/fields/winlog.yml:198 - winlog.event_data.Signed : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:394 - winlog.event_data.Signed : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:198 - winlog.event_data.Signed : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:232 - winlog.event_data.MinimumThrottlePercent : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:130 - winlog.event_data.MinimumThrottlePercent : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:130 - winlog.event_data.MinimumThrottlePercent : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:348 - winlog.user.type : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:627 - winlog.user.type : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:348 - winlog.user.type : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/ecs.yml:41 - process.args : [Duplicate field (2 times).]
packages/system/data_stream/process/fields/ecs.yml:43 - process.args : [Duplicate field (2 times).]
packages/system/data_stream/security/fields/winlog.yml:432 - winlog.event_data.TargetLogonGuid : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:222 - winlog.event_data.TargetLogonGuid : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:222 - winlog.event_data.TargetLogonGuid : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:260 - winlog.event_id : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:260 - winlog.event_id : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:496 - winlog.event_id : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:150 - winlog.event_data.DriverName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:72 - winlog.event_data.DriverName : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:72 - winlog.event_data.DriverName : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:62 - winlog.event_data.DeviceNameLength : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:128 - winlog.event_data.DeviceNameLength : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:62 - winlog.event_data.DeviceNameLength : [Duplicate field (3 times).]
packages/system/data_stream/auth/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/process_summary/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/syslog/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/diskio/fields/ecs.yml:9 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/uptime/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/system/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/process/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/network/fields/ecs.yml:13 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/auth/fields/ecs.yml:39 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/syslog/fields/ecs.yml:31 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/security/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:13 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/cpu/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/diskio/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/auth/fields/ecs.yml:41 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/filesystem/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/core/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/fsstat/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/load/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:13 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/memory/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/application/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/network/fields/agent.yml:108 - host.hostname : [Duplicate field (24 times).]
packages/system/data_stream/fsstat/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/auth/fields/ecs.yml:45 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/cpu/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/load/fields/ecs.yml:5 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/cpu/fields/ecs.yml:5 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/uptime/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/network/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/load/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/memory/fields/ecs.yml:5 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/system/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/core/fields/ecs.yml:5 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/syslog/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/syslog/fields/ecs.yml:35 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/security/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/core/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/process_summary/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/diskio/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/filesystem/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/process/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/diskio/fields/ecs.yml:5 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/fsstat/fields/ecs.yml:5 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/application/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/auth/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/memory/fields/agent.yml:124 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/process/fields/ecs.yml:21 - host.ip : [Duplicate field (26 times).]
packages/system/data_stream/security/fields/winlog.yml:134 - winlog.event_data.DeviceVersionMinor : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:68 - winlog.event_data.DeviceVersionMinor : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:68 - winlog.event_data.DeviceVersionMinor : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:70 - winlog.event_data.DriveName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:148 - winlog.event_data.DriveName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:70 - winlog.event_data.DriveName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:134 - winlog.event_data.NewProcessId : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:134 - winlog.event_data.NewProcessId : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:238 - winlog.event_data.NewProcessId : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:25 - winlog.event_data : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:25 - winlog.event_data : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:45 - winlog.event_data : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:250 - winlog.event_data.param4 : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:250 - winlog.event_data.param4 : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:486 - winlog.event_data.param4 : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/ecs.yml:3 - event.code : [Duplicate field (5 times).]
packages/system/data_stream/system/fields/ecs.yml:7 - event.code : [Duplicate field (5 times).]
packages/system/data_stream/syslog/fields/ecs.yml:9 - event.code : [Duplicate field (5 times).]
packages/system/data_stream/auth/fields/ecs.yml:11 - event.code : [Duplicate field (5 times).]
packages/system/data_stream/security/fields/ecs.yml:7 - event.code : [Duplicate field (5 times).]
packages/system/data_stream/diskio/fields/agent.yml:205 - host.disk.write.bytes : [Duplicate field (2 times).]
packages/system/data_stream/diskio/fields/fields.yml:131 - host.disk.write.bytes : [Duplicate field (2 times).]
packages/system/data_stream/application/fields/winlog.yml:254 - winlog.event_data.param6 : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:490 - winlog.event_data.param6 : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:254 - winlog.event_data.param6 : [Duplicate field (3 times).]
packages/system/data_stream/process_summary/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/agent.yml:33 - cloud.machine.type : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/ecs.yml:57 - process.parent.pid : [Duplicate field (2 times).]
packages/system/data_stream/process/fields/ecs.yml:9 - process.parent.pid : [Duplicate field (2 times).]
packages/system/data_stream/system/fields/winlog.yml:200 - winlog.event_data.StartTime : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:396 - winlog.event_data.StartTime : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:200 - winlog.event_data.StartTime : [Duplicate field (3 times).]
packages/system/data_stream/network/fields/ecs.yml:39 - source.port : [Duplicate field (5 times).]
packages/system/data_stream/security/fields/ecs.yml:99 - source.port : [Duplicate field (5 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:39 - source.port : [Duplicate field (5 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:39 - source.port : [Duplicate field (5 times).]
packages/system/data_stream/auth/fields/ecs.yml:95 - source.port : [Duplicate field (5 times).]
packages/system/data_stream/system/fields/winlog.yml:124 - winlog.event_data.MemberName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:226 - winlog.event_data.MemberName : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:124 - winlog.event_data.MemberName : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:138 - winlog.event_data.NewSchemeGuid : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:242 - winlog.event_data.NewSchemeGuid : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:138 - winlog.event_data.NewSchemeGuid : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:190 - winlog.event_data.ShutdownEventCode : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:190 - winlog.event_data.ShutdownEventCode : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:384 - winlog.event_data.ShutdownEventCode : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:66 - winlog.event_data.DeviceVersionMajor : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:132 - winlog.event_data.DeviceVersionMajor : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:66 - winlog.event_data.DeviceVersionMajor : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:166 - winlog.event_data.ProcessPath : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:328 - winlog.event_data.ProcessPath : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:166 - winlog.event_data.ProcessPath : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:350 - winlog.event_data.SchemaVersion : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:180 - winlog.event_data.SchemaVersion : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:180 - winlog.event_data.SchemaVersion : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:162 - winlog.event_data.ExtraInfo : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:80 - winlog.event_data.ExtraInfo : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:80 - winlog.event_data.ExtraInfo : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:98 - winlog.event_data.IntegrityLevel : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:190 - winlog.event_data.IntegrityLevel : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:98 - winlog.event_data.IntegrityLevel : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:266 - winlog.keywords : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:502 - winlog.keywords : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:266 - winlog.keywords : [Duplicate field (3 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:54 - cloud.image.id : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:193 - host.os.codename : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/winlog.yml:130 - winlog.event_data.DeviceTime : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:64 - winlog.event_data.DeviceTime : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:64 - winlog.event_data.DeviceTime : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:60 - winlog.event_data.DeviceName : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:60 - winlog.event_data.DeviceName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:126 - winlog.event_data.DeviceName : [Duplicate field (3 times).]
packages/system/data_stream/auth/fields/ecs.yml:15 - event.ingested : [Duplicate field (5 times).]
packages/system/data_stream/system/fields/ecs.yml:11 - event.ingested : [Duplicate field (5 times).]
packages/system/data_stream/syslog/fields/ecs.yml:13 - event.ingested : [Duplicate field (5 times).]
packages/system/data_stream/security/fields/ecs.yml:11 - event.ingested : [Duplicate field (5 times).]
packages/system/data_stream/application/fields/ecs.yml:7 - event.ingested : [Duplicate field (5 times).]
packages/system/data_stream/fsstat/fields/base-fields.yml:4 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/base-fields.yml:5 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/base-fields.yml:4 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/base-fields.yml:4 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/base-fields.yml:5 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/base-fields.yml:4 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/base-fields.yml:4 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/base-fields.yml:4 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/base-fields.yml:4 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/base-fields.yml:4 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/base-fields.yml:5 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/base-fields.yml:4 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/base-fields.yml:4 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/base-fields.yml:4 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/base-fields.yml:4 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/base-fields.yml:4 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/base-fields.yml:4 - data_stream.dataset : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/core/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/fsstat/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/cpu/fields/ecs.yml:17 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/diskio/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/memory/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/diskio/fields/ecs.yml:19 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/uptime/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/security/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/filesystem/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/cpu/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/application/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/auth/fields/ecs.yml:57 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/syslog/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/syslog/fields/ecs.yml:47 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/fsstat/fields/ecs.yml:17 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/core/fields/ecs.yml:17 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/auth/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/load/fields/ecs.yml:17 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/process/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/process/fields/ecs.yml:33 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/system/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/memory/fields/ecs.yml:17 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/network/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/load/fields/agent.yml:152 - host.os.name : [Duplicate field (26 times).]
packages/system/data_stream/system/fields/winlog.yml:252 - winlog.event_data.param5 : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:252 - winlog.event_data.param5 : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:488 - winlog.event_data.param5 : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:204 - winlog.event_data.LmPackageName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:110 - winlog.event_data.LmPackageName : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:110 - winlog.event_data.LmPackageName : [Duplicate field (3 times).]
packages/system/data_stream/load/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/agent.yml:70 - container.image.name : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/winlog.yml:236 - winlog.event_data.TransmittedServices : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:236 - winlog.event_data.TransmittedServices : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:462 - winlog.event_data.TransmittedServices : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:234 - winlog.event_data.TokenElevationType : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:234 - winlog.event_data.TokenElevationType : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:460 - winlog.event_data.TokenElevationType : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:390 - winlog.event_data.Signature : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:194 - winlog.event_data.Signature : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:194 - winlog.event_data.Signature : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:400 - winlog.event_data.Status : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:204 - winlog.event_data.Status : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:204 - winlog.event_data.Status : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:228 - winlog.event_data.MemberSid : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:126 - winlog.event_data.MemberSid : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:126 - winlog.event_data.MemberSid : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:13 - winlog.activity_id : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:13 - winlog.activity_id : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:15 - winlog.activity_id : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/ecs.yml:79 - source.as.organization.name : [Duplicate field (2 times).]
packages/system/data_stream/auth/fields/ecs.yml:75 - source.as.organization.name : [Duplicate field (2 times).]
packages/system/data_stream/memory/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:182 - host.containerized : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/winlog.yml:52 - winlog.event_data.CorruptionActionState : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:52 - winlog.event_data.CorruptionActionState : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:116 - winlog.event_data.CorruptionActionState : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:442 - winlog.event_data.TargetUserSid : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:230 - winlog.event_data.TargetUserSid : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:230 - winlog.event_data.TargetUserSid : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:39 - cloud.provider : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/agent.yml:187 - host.os.build : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/winlog.yml:314 - winlog.event_data.PreviousCreationUtcTime : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:156 - winlog.event_data.PreviousCreationUtcTime : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:156 - winlog.event_data.PreviousCreationUtcTime : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:332 - winlog.event_data.Product : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:170 - winlog.event_data.Product : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:170 - winlog.event_data.Product : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:182 - winlog.event_data.ScriptBlockText : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:356 - winlog.event_data.ScriptBlockText : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:182 - winlog.event_data.ScriptBlockText : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/ecs.yml:49 - process.executable : [Duplicate field (2 times).]
packages/system/data_stream/process/fields/ecs.yml:47 - process.executable : [Duplicate field (2 times).]
packages/system/data_stream/application/fields/winlog.yml:178 - winlog.event_data.Reason : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:178 - winlog.event_data.Reason : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:342 - winlog.event_data.Reason : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:192 - winlog.event_data.ShutdownReason : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:192 - winlog.event_data.ShutdownReason : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:386 - winlog.event_data.ShutdownReason : [Duplicate field (3 times).]
packages/system/data_stream/cpu/fields/fields.yml:177 - host.cpu.pct : [Duplicate field (2 times).]
packages/system/data_stream/cpu/fields/agent.yml:199 - host.cpu.pct : [Duplicate field (2 times).]
packages/system/data_stream/network/fields/agent.yml:199 - host.network.in.bytes : [Duplicate field (2 times).]
packages/system/data_stream/network/fields/fields.yml:55 - host.network.in.bytes : [Duplicate field (2 times).]
packages/system/data_stream/auth/fields/ecs.yml:67 - related.hosts : [Duplicate field (2 times).]
packages/system/data_stream/security/fields/ecs.yml:65 - related.hosts : [Duplicate field (2 times).]
packages/system/data_stream/socket_summary/fields/base-fields.yml:17 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/base-fields.yml:17 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/base-fields.yml:18 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/base-fields.yml:17 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/base-fields.yml:17 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/base-fields.yml:17 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/base-fields.yml:14 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/base-fields.yml:17 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/base-fields.yml:17 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/base-fields.yml:17 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/base-fields.yml:17 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/base-fields.yml:17 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/base-fields.yml:14 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/base-fields.yml:17 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/base-fields.yml:17 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/base-fields.yml:17 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/base-fields.yml:17 - event.dataset : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/winlog.yml:116 - winlog.event_data.LogonProcessName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:214 - winlog.event_data.LogonProcessName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:116 - winlog.event_data.LogonProcessName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:278 - winlog.record_id : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:278 - winlog.record_id : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:520 - winlog.record_id : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:246 - winlog.event_data.param2 : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:482 - winlog.event_data.param2 : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:246 - winlog.event_data.param2 : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:354 - winlog.version : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:633 - winlog.version : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:354 - winlog.version : [Duplicate field (3 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:23 - source.geo.city_name : [Duplicate field (5 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:23 - source.geo.city_name : [Duplicate field (5 times).]
packages/system/data_stream/auth/fields/ecs.yml:77 - source.geo.city_name : [Duplicate field (5 times).]
packages/system/data_stream/security/fields/ecs.yml:81 - source.geo.city_name : [Duplicate field (5 times).]
packages/system/data_stream/network/fields/ecs.yml:23 - source.geo.city_name : [Duplicate field (5 times).]
packages/system/data_stream/auth/fields/ecs.yml:99 - user.id : [Duplicate field (5 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:43 - user.id : [Duplicate field (5 times).]
packages/system/data_stream/network/fields/ecs.yml:43 - user.id : [Duplicate field (5 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:43 - user.id : [Duplicate field (5 times).]
packages/system/data_stream/security/fields/ecs.yml:103 - user.id : [Duplicate field (5 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:33 - source.geo.region_iso_code : [Duplicate field (5 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:33 - source.geo.region_iso_code : [Duplicate field (5 times).]
packages/system/data_stream/auth/fields/ecs.yml:89 - source.geo.region_iso_code : [Duplicate field (5 times).]
packages/system/data_stream/security/fields/ecs.yml:93 - source.geo.region_iso_code : [Duplicate field (5 times).]
packages/system/data_stream/network/fields/ecs.yml:33 - source.geo.region_iso_code : [Duplicate field (5 times).]
packages/system/data_stream/security/fields/ecs.yml:87 - source.geo.country_name : [Duplicate field (2 times).]
packages/system/data_stream/auth/fields/ecs.yml:83 - source.geo.country_name : [Duplicate field (2 times).]
packages/system/data_stream/system/fields/winlog.yml:188 - winlog.event_data.ShutdownActionType : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:188 - winlog.event_data.ShutdownActionType : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:382 - winlog.event_data.ShutdownActionType : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:50 - winlog.event_data.Company : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:50 - winlog.event_data.Company : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:112 - winlog.event_data.Company : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:206 - winlog.event_data.LogonGuid : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:112 - winlog.event_data.LogonGuid : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:112 - winlog.event_data.LogonGuid : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:480 - winlog.event_data.param1 : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:244 - winlog.event_data.param1 : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:244 - winlog.event_data.param1 : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:256 - winlog.event_data.param7 : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:492 - winlog.event_data.param7 : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:256 - winlog.event_data.param7 : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/ecs.yml:67 - related.ip : [Duplicate field (2 times).]
packages/system/data_stream/auth/fields/ecs.yml:69 - related.ip : [Duplicate field (2 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:5 - group : [Duplicate field (3 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:5 - group : [Duplicate field (3 times).]
packages/system/data_stream/network/fields/ecs.yml:5 - group : [Duplicate field (3 times).]
packages/system/data_stream/network/fields/ecs.yml:11 - host : [Duplicate field (10 times).]
packages/system/data_stream/cpu/fields/ecs.yml:1 - host : [Duplicate field (10 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:11 - host : [Duplicate field (10 times).]
packages/system/data_stream/core/fields/ecs.yml:1 - host : [Duplicate field (10 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:11 - host : [Duplicate field (10 times).]
packages/system/data_stream/diskio/fields/ecs.yml:1 - host : [Duplicate field (10 times).]
packages/system/data_stream/process/fields/ecs.yml:17 - host : [Duplicate field (10 times).]
packages/system/data_stream/load/fields/ecs.yml:1 - host : [Duplicate field (10 times).]
packages/system/data_stream/fsstat/fields/ecs.yml:1 - host : [Duplicate field (10 times).]
packages/system/data_stream/memory/fields/ecs.yml:1 - host : [Duplicate field (10 times).]
packages/system/data_stream/uptime/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:22 - cloud.instance.id : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/ecs.yml:29 - host.os.full : [Duplicate field (9 times).]
packages/system/data_stream/syslog/fields/ecs.yml:43 - host.os.full : [Duplicate field (9 times).]
packages/system/data_stream/cpu/fields/ecs.yml:13 - host.os.full : [Duplicate field (9 times).]
packages/system/data_stream/memory/fields/ecs.yml:13 - host.os.full : [Duplicate field (9 times).]
packages/system/data_stream/diskio/fields/ecs.yml:15 - host.os.full : [Duplicate field (9 times).]
packages/system/data_stream/core/fields/ecs.yml:13 - host.os.full : [Duplicate field (9 times).]
packages/system/data_stream/load/fields/ecs.yml:13 - host.os.full : [Duplicate field (9 times).]
packages/system/data_stream/auth/fields/ecs.yml:53 - host.os.full : [Duplicate field (9 times).]
packages/system/data_stream/fsstat/fields/ecs.yml:13 - host.os.full : [Duplicate field (9 times).]
packages/system/data_stream/security/fields/winlog.yml:330 - winlog.event_data.ProcessPid : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:168 - winlog.event_data.ProcessPid : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:168 - winlog.event_data.ProcessPid : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:172 - winlog.event_data.PuaCount : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:172 - winlog.event_data.PuaCount : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:336 - winlog.event_data.PuaCount : [Duplicate field (3 times).]
packages/system/data_stream/syslog/fields/ecs.yml:55 - process.pid : [Duplicate field (7 times).]
packages/system/data_stream/security/fields/ecs.yml:59 - process.pid : [Duplicate field (7 times).]
packages/system/data_stream/auth/fields/ecs.yml:65 - process.pid : [Duplicate field (7 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:19 - process.pid : [Duplicate field (7 times).]
packages/system/data_stream/process/fields/ecs.yml:7 - process.pid : [Duplicate field (7 times).]
packages/system/data_stream/network/fields/ecs.yml:19 - process.pid : [Duplicate field (7 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:19 - process.pid : [Duplicate field (7 times).]
packages/system/data_stream/security/fields/winlog.yml:198 - winlog.event_data.KeyLength : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:104 - winlog.event_data.KeyLength : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:104 - winlog.event_data.KeyLength : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:206 - winlog.event_data.StopTime : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:404 - winlog.event_data.StopTime : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:206 - winlog.event_data.StopTime : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:323 - winlog.user_data : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:580 - winlog.user_data : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:323 - winlog.user_data : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:272 - winlog.channel : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:272 - winlog.channel : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:21 - winlog.channel : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:154 - winlog.event_data.PerformanceImplementation : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:154 - winlog.event_data.PerformanceImplementation : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:312 - winlog.event_data.PerformanceImplementation : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:302 - winlog.process.pid : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:302 - winlog.process.pid : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:544 - winlog.process.pid : [Duplicate field (3 times).]
packages/system/data_stream/syslog/fields/ecs.yml:1 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/system/fields/base-fields.yml:10 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/load/fields/base-fields.yml:10 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/memory/fields/base-fields.yml:10 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/fsstat/fields/base-fields.yml:10 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/filesystem/fields/base-fields.yml:10 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/auth/fields/base-fields.yml:11 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/auth/fields/ecs.yml:1 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/network/fields/base-fields.yml:10 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/network/fields/ecs.yml:1 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/process/fields/base-fields.yml:10 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/diskio/fields/base-fields.yml:10 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/uptime/fields/base-fields.yml:10 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:1 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/syslog/fields/base-fields.yml:11 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/socket_summary/fields/base-fields.yml:10 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/cpu/fields/base-fields.yml:10 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/application/fields/base-fields.yml:10 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:1 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/process_summary/fields/base-fields.yml:10 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/security/fields/base-fields.yml:11 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/core/fields/base-fields.yml:10 - @timestamp : [Duplicate field (22 times).]
packages/system/data_stream/auth/fields/ecs.yml:55 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/core/fields/ecs.yml:15 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/auth/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/syslog/fields/ecs.yml:45 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/fsstat/fields/ecs.yml:15 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/syslog/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/process/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/load/fields/ecs.yml:15 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/core/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/cpu/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/filesystem/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/application/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/security/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/system/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/load/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/uptime/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/memory/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/diskio/fields/ecs.yml:17 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/memory/fields/ecs.yml:15 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/process/fields/ecs.yml:31 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/diskio/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/network/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/process_summary/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/cpu/fields/ecs.yml:15 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/fsstat/fields/agent.yml:146 - host.os.kernel : [Duplicate field (26 times).]
packages/system/data_stream/security/fields/winlog.yml:392 - winlog.event_data.SignatureStatus : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:196 - winlog.event_data.SignatureStatus : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:196 - winlog.event_data.SignatureStatus : [Duplicate field (3 times).]
packages/system/data_stream/syslog/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:8 - cloud.account.id : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/ecs.yml:1 - error.message : [Duplicate field (4 times).]
packages/system/data_stream/security/fields/ecs.yml:139 - error.message : [Duplicate field (4 times).]
packages/system/data_stream/auth/fields/ecs.yml:5 - error.message : [Duplicate field (4 times).]
packages/system/data_stream/application/fields/ecs.yml:1 - error.message : [Duplicate field (4 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:37 - source.ip : [Duplicate field (5 times).]
packages/system/data_stream/network/fields/ecs.yml:37 - source.ip : [Duplicate field (5 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:37 - source.ip : [Duplicate field (5 times).]
packages/system/data_stream/auth/fields/ecs.yml:93 - source.ip : [Duplicate field (5 times).]
packages/system/data_stream/security/fields/ecs.yml:97 - source.ip : [Duplicate field (5 times).]
packages/system/data_stream/filesystem/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:28 - cloud.instance.name : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/ecs.yml:29 - event.type : [Duplicate field (4 times).]
packages/system/data_stream/system/fields/ecs.yml:25 - event.type : [Duplicate field (4 times).]
packages/system/data_stream/security/fields/ecs.yml:25 - event.type : [Duplicate field (4 times).]
packages/system/data_stream/syslog/fields/ecs.yml:25 - event.type : [Duplicate field (4 times).]
packages/system/data_stream/system/fields/winlog.yml:202 - winlog.event_data.State : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:398 - winlog.event_data.State : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:202 - winlog.event_data.State : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:240 - winlog.event_data.NewProcessName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:136 - winlog.event_data.NewProcessName : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:136 - winlog.event_data.NewProcessName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:577 - winlog.process.thread.id : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:320 - winlog.process.thread.id : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:320 - winlog.process.thread.id : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/base-fields.yml:1 - data_stream.type : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/fsstat/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/cpu/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/uptime/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/memory/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/network/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/process/fields/ecs.yml:37 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/process/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/load/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/core/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/application/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/memory/fields/ecs.yml:21 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/auth/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/system/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/cpu/fields/ecs.yml:21 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/load/fields/ecs.yml:21 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/syslog/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/filesystem/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/fsstat/fields/ecs.yml:21 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/core/fields/ecs.yml:21 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/security/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/diskio/fields/ecs.yml:23 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/process_summary/fields/agent.yml:169 - host.os.version : [Duplicate field (24 times).]
packages/system/data_stream/system/fields/winlog.yml:106 - winlog.event_data.LastBootGood : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:200 - winlog.event_data.LastBootGood : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:106 - winlog.event_data.LastBootGood : [Duplicate field (3 times).]
packages/system/data_stream/network/fields/agent.yml:205 - host.network.in.packets : [Duplicate field (2 times).]
packages/system/data_stream/network/fields/fields.yml:68 - host.network.in.packets : [Duplicate field (2 times).]
packages/system/data_stream/security/fields/winlog.yml:324 - winlog.event_data.ProcessId : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:162 - winlog.event_data.ProcessId : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:162 - winlog.event_data.ProcessId : [Duplicate field (3 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:45 - user.name : [Duplicate field (6 times).]
packages/system/data_stream/auth/fields/ecs.yml:101 - user.name : [Duplicate field (6 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:45 - user.name : [Duplicate field (6 times).]
packages/system/data_stream/security/fields/ecs.yml:105 - user.name : [Duplicate field (6 times).]
packages/system/data_stream/network/fields/ecs.yml:45 - user.name : [Duplicate field (6 times).]
packages/system/data_stream/process/fields/ecs.yml:15 - user.name : [Duplicate field (6 times).]
packages/system/data_stream/security/fields/winlog.yml:156 - winlog.event_data.DwordVal : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:76 - winlog.event_data.DwordVal : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:76 - winlog.event_data.DwordVal : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:214 - winlog.event_data.SubjectUserSid : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:214 - winlog.event_data.SubjectUserSid : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:422 - winlog.event_data.SubjectUserSid : [Duplicate field (3 times).]
packages/system/data_stream/diskio/fields/fields.yml:125 - host.disk.read.bytes : [Duplicate field (2 times).]
packages/system/data_stream/diskio/fields/agent.yml:199 - host.disk.read.bytes : [Duplicate field (2 times).]
packages/system/data_stream/system/fields/winlog.yml:186 - winlog.event_data.ServiceVersion : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:374 - winlog.event_data.ServiceVersion : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:186 - winlog.event_data.ServiceVersion : [Duplicate field (3 times).]
packages/system/data_stream/core/fields/base-fields.yml:7 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/base-fields.yml:7 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/base-fields.yml:7 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/base-fields.yml:7 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/base-fields.yml:7 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/base-fields.yml:8 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/base-fields.yml:7 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/base-fields.yml:7 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/process/fields/base-fields.yml:7 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/base-fields.yml:7 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/base-fields.yml:7 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/base-fields.yml:8 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/base-fields.yml:7 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/base-fields.yml:7 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/base-fields.yml:7 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/base-fields.yml:8 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/base-fields.yml:7 - data_stream.namespace : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/ecs.yml:23 - event.sequence : [Duplicate field (4 times).]
packages/system/data_stream/syslog/fields/ecs.yml:23 - event.sequence : [Duplicate field (4 times).]
packages/system/data_stream/auth/fields/ecs.yml:27 - event.sequence : [Duplicate field (4 times).]
packages/system/data_stream/security/fields/ecs.yml:23 - event.sequence : [Duplicate field (4 times).]
packages/system/data_stream/application/fields/winlog.yml:330 - winlog.user.identifier : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:330 - winlog.user.identifier : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:607 - winlog.user.identifier : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:426 - winlog.event_data.TSId : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:216 - winlog.event_data.TSId : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:216 - winlog.event_data.TSId : [Duplicate field (3 times).]
packages/system/data_stream/network/fields/fields.yml:73 - host.network.out.packets : [Duplicate field (2 times).]
packages/system/data_stream/network/fields/agent.yml:216 - host.network.out.packets : [Duplicate field (2 times).]
packages/system/data_stream/application/fields/winlog.yml:38 - winlog.event_data.AuthenticationPackageName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:38 - winlog.event_data.AuthenticationPackageName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:86 - winlog.event_data.AuthenticationPackageName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/ecs.yml:111 - user.effective.name : [Duplicate field (2 times).]
packages/system/data_stream/auth/fields/ecs.yml:97 - user.effective.name : [Duplicate field (2 times).]
packages/system/data_stream/application/fields/winlog.yml:164 - winlog.event_data.ProcessName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:326 - winlog.event_data.ProcessName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:164 - winlog.event_data.ProcessName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:248 - winlog.event_data.param3 : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:484 - winlog.event_data.param3 : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:248 - winlog.event_data.param3 : [Duplicate field (3 times).]
packages/system/data_stream/network/fields/fields.yml:62 - host.network.out.bytes : [Duplicate field (2 times).]
packages/system/data_stream/network/fields/agent.yml:210 - host.network.out.bytes : [Duplicate field (2 times).]
packages/system/data_stream/security/fields/winlog.yml:220 - winlog.event_data.MajorVersion : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:120 - winlog.event_data.MajorVersion : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:120 - winlog.event_data.MajorVersion : [Duplicate field (3 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:15 - process : [Duplicate field (4 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:15 - process : [Duplicate field (4 times).]
packages/system/data_stream/network/fields/ecs.yml:15 - process : [Duplicate field (4 times).]
packages/system/data_stream/process/fields/ecs.yml:1 - process : [Duplicate field (4 times).]
packages/system/data_stream/process_summary/fields/ecs.yml:35 - source.geo.region_name : [Duplicate field (5 times).]
packages/system/data_stream/socket_summary/fields/ecs.yml:35 - source.geo.region_name : [Duplicate field (5 times).]
packages/system/data_stream/security/fields/ecs.yml:95 - source.geo.region_name : [Duplicate field (5 times).]
packages/system/data_stream/auth/fields/ecs.yml:91 - source.geo.region_name : [Duplicate field (5 times).]
packages/system/data_stream/network/fields/ecs.yml:35 - source.geo.region_name : [Duplicate field (5 times).]
packages/system/data_stream/system/fields/winlog.yml:228 - winlog.event_data.TargetUserName : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:228 - winlog.event_data.TargetUserName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:440 - winlog.event_data.TargetUserName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:19 - winlog.computer_name : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:27 - winlog.computer_name : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:19 - winlog.computer_name : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:48 - winlog.event_data.BuildVersion : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:48 - winlog.event_data.BuildVersion : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:96 - winlog.event_data.BuildVersion : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:96 - winlog.event_data.ImpersonationLevel : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:96 - winlog.event_data.ImpersonationLevel : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:188 - winlog.event_data.ImpersonationLevel : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:268 - winlog.event_data.Number : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:144 - winlog.event_data.Number : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:144 - winlog.event_data.Number : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:146 - winlog.event_data.OldSchemeGuid : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:146 - winlog.event_data.OldSchemeGuid : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:278 - winlog.event_data.OldSchemeGuid : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:308 - winlog.provider_name : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:308 - winlog.provider_name : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:550 - winlog.provider_name : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:300 - winlog.event_data.OriginalFileName : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:150 - winlog.event_data.OriginalFileName : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:150 - winlog.event_data.OriginalFileName : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:176 - winlog.event_data.QfeVersion : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:176 - winlog.event_data.QfeVersion : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:340 - winlog.event_data.QfeVersion : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:234 - winlog.event_data.MinorVersion : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:132 - winlog.event_data.MinorVersion : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:132 - winlog.event_data.MinorVersion : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:152 - winlog.event_data.Path : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:152 - winlog.event_data.Path : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:308 - winlog.event_data.Path : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:184 - winlog.event_data.ServiceName : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:184 - winlog.event_data.ServiceName : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:364 - winlog.event_data.ServiceName : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:88 - winlog.event_data.FinalStatus : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:88 - winlog.event_data.FinalStatus : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:172 - winlog.event_data.FinalStatus : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:337 - winlog.user.name : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:337 - winlog.user.name : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:616 - winlog.user.name : [Duplicate field (3 times).]
packages/system/data_stream/process/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/socket_summary/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/load/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/system/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/syslog/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/process_summary/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/core/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/diskio/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/network/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/cpu/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/auth/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/application/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/uptime/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/filesystem/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/memory/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/fsstat/fields/agent.yml:80 - container.name : [Duplicate field (17 times).]
packages/system/data_stream/security/fields/winlog.yml:94 - winlog.event_data.BootType : [Duplicate field (3 times).]
packages/system/data_stream/system/fields/winlog.yml:46 - winlog.event_data.BootType : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:46 - winlog.event_data.BootType : [Duplicate field (3 times).]
packages/system/data_stream/syslog/fields/ecs.yml:19 - event.outcome : [Duplicate field (4 times).]
packages/system/data_stream/auth/fields/ecs.yml:23 - event.outcome : [Duplicate field (4 times).]
packages/system/data_stream/security/fields/ecs.yml:19 - event.outcome : [Duplicate field (4 times).]
packages/system/data_stream/system/fields/ecs.yml:19 - event.outcome : [Duplicate field (4 times).]
packages/system/data_stream/auth/fields/ecs.yml:73 - source.as.number : [Duplicate field (2 times).]
packages/system/data_stream/security/fields/ecs.yml:77 - source.as.number : [Duplicate field (2 times).]
packages/system/data_stream/system/fields/winlog.yml:296 - winlog.provider_guid : [Duplicate field (3 times).]
packages/system/data_stream/security/fields/winlog.yml:538 - winlog.provider_guid : [Duplicate field (3 times).]
packages/system/data_stream/application/fields/winlog.yml:296 - winlog.provider_guid : [Duplicate field (3 times).]

andrewkroh
andrewkroh approved these changes Oct 31, 2022
View reviewed changes
@efd6 efd6 force-pushed the 4474-system.auth branch from 87d727e to ef169ff Compare November 2, 2022 21:33
@andrewkroh
Copy link
Copy Markdown
Member

andrewkroh commented Nov 14, 2022

I ran elastic-package lint on this using the version of elastic-package from go.mod and I couldn't reproduce. 🤔

@efd6
Copy link
Copy Markdown
Contributor Author

efd6 commented Nov 14, 2022

I've seen a number of cases where CI and local builds differ. My suspicion is that this is a macos v linux difference, but I have not tested this.

@botelastic
Copy link
Copy Markdown

botelastic bot commented Dec 14, 2022

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

@botelastic botelastic bot added the Stalled label Dec 14, 2022
@efd6
Copy link
Copy Markdown
Contributor Author

efd6 commented Dec 14, 2022

@cmacknz How do you feel about merging this despite the CI failure. The failure is due to the field duplication causing package builds to differ between platforms. These will need to be fixed for this package at some point for migration to the v2 format, but I think that should be a separate PR.

@botelastic botelastic bot removed the Stalled label Dec 14, 2022
@cmacknz
Copy link
Copy Markdown
Member

cmacknz commented Dec 14, 2022

The failure is due to the field duplication causing package builds to differ between platforms. These will need to be fixed for this package at some point for migration to the v2 format, but I think that should be a separate PR.

I am a bit hesitant to merge a known broken or flaky test if we already have an idea of what the fix is.

Is there any particular reason to do the fix as a separate PR? If it is just making sure both changes can be reviewed separately, could the test fix be done as a PR against the branch with this change? Then we could merge the changes together, or immediately one after another.

@efd6
Copy link
Copy Markdown
Contributor Author

efd6 commented Dec 14, 2022

A separate PR would be fine. The package is essentially broken as it is due to weirdness in the CI, so any PR against it will be a failing test until that happens.

@botelastic
Copy link
Copy Markdown

botelastic bot commented Jan 13, 2023

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

@botelastic botelastic bot added the Stalled label Jan 13, 2023
@botelastic botelastic bot removed the Stalled label Jan 17, 2023
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Jan 17, 2023 •
edited
Loading

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (3/3) 💚
Files 100.0% (4/4) 💚
Classes 100.0% (4/4) 💚
Methods 60.759% (48/79) 👍 32.188
Lines 99.527% (2736/2749) 👎 -0.473
Conditionals 100.0% (0/0) 💚

@efd6
Copy link
Copy Markdown
Contributor Author

efd6 commented Jan 17, 2023

@cmacknz Would you approve please?

@efd6 efd6 merged commit ef38d55 into elastic:main Jan 19, 2023
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Jan 19, 2023

Package system - 1.22.0 containing this change is available at https://epr.elastic.co/search?package=system

@efd6 efd6 deleted the 4474-system.auth branch February 5, 2025 22:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cmacknz cmacknz cmacknz approved these changes

@andrewkroh andrewkroh andrewkroh approved these changes

@fearful-symmetry fearful-symmetry Awaiting requested review from fearful-symmetry fearful-symmetry was automatically assigned from elastic/elastic-agent-data-plane

Assignees

@efd6 efd6

Labels

enhancement New feature or request Integration:system System Team:Elastic-Agent-Data-Plane Agent Data Plane team [elastic/elastic-agent-data-plane]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Linux System Integration (system.auth) IAM events parsing problems

4 participants

@efd6 @elasticmachine @andrewkroh @cmacknz