Filebeat logs have a string field called "source" which is the filepath to the file that the filebeat log is coming from.
Packetbeat logs of type "flow" have an object field called"source" which has the properties ip, port, stats, and mac.
I ran into a situation where both of these beats were writing to the same elasticsearch instance. When I tried to look up logs in Kibana, I couldn't find filebeat logs, but found log entries with an "indexed-failed-reason": that reads as follows:
"type":"illegal_argument_exception","reason":"[source] is defined as a field in mapping [log] but this name is already used for an object in other types"
I feel like the default fields for all the beats shouldn't conflict with each other. Would it be possible to change either of the field names here?