# Conflicts in Azure Fleet Integrations

**URL:** <https://discuss.elastic.co/t/conflicts-in-azure-fleet-integrations/283236>\
**Category:** Beats\
**Tags:** filebeat, elastic-agent\
**Created:** [September 3, 2021, 4:54am UTC](https://discuss.elastic.co/t/conflicts-in-azure-fleet-integrations/283236 "2021-09-03T04:54:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![PhilA](https://avatars.discourse-cdn.com/v4/letter/p/c6cbf5/32.png) [@PhilA](https://discuss.elastic.co/u/PhilA)\
**Post date:** [September 3, 2021, 4:54am UTC](https://discuss.elastic.co/t/conflicts-in-azure-fleet-integrations/283236/1 "2021-09-03T04:54:46Z")

</div>

Hi

I think there is an issue with the current Azure logs integration for Fleet (Azure logs integration v0.8.5). I am working with this to try and pull in various logs from Azure and have noticed field conflicts in my logs-\* index pattern. These are all Elastic generated indicies.

Steps taken to investigate so far:

The index patterns page tells me that there are 2 conflicts; client.ip and error.message.

Using dev tools, I ran  
`GET /logs-*/_mapping/field/client.ip`

This returned lots but picking out 2 key bits here, note that 2 indicies, both Azure default ones have client.ip field listed and one shows type IP and the other shows type keyword. It seems that the following have client.ip set to keyword:

- platformlogs
- auditlogs

But the following are correct and have it set as type IP:

- signinlogs
- activitylogs

```auto
  ".ds-logs-azure.platformlogs-default-2021.09.02-000001" : {
    "mappings" : {
      "client.ip" : {
        "full_name" : "client.ip",
        "mapping" : {
          "ip" : {
            "type" : "keyword",
            "ignore_above" : 1024
          }
        }
      }
    }
  },
  ".ds-logs-elastic_agent.filebeat-default-2021.06.15-000008" : {
    "mappings" : { }
  },
  ".ds-logs-elastic_agent.metricbeat-default-2021.08.30-000009" : {
    "mappings" : { }
  },
  ".ds-logs-azure.activitylogs-default-2021.09.02-000001" : {
    "mappings" : {
      "client.ip" : {
        "full_name" : "client.ip",
        "mapping" : {
          "ip" : {
            "type" : "ip"
          }

```

There are also conflicts on the error.message field which sometimes shows as type text and other times keyword. I can get more details on this if needed but just wanted to start by verifying if I am correct and this is a bug.

Thanks

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [September 3, 2021, 11:30am UTC](https://discuss.elastic.co/t/conflicts-in-azure-fleet-integrations/283236/2 "2021-09-03T11:30:25Z")

</div>

I have not digged into in details but I assume these fields are missing in the package: [https://github.com/elastic/integrations/tree/master/packages/azure/data\_stream/platformlogs/fields](https://github.com/elastic/integrations/tree/master/packages/azure/data_stream/platformlogs/fields)

@MarianaD To not have to add all ECS fields with \*.ip, maybe we can add a dynamic mapping that matches?

---

<div class="post-metadata">

**Author:** ![MarianaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marianad/32/42687_2.png) [@MarianaD](https://discuss.elastic.co/u/MarianaD)\
**Post date:** [September 8, 2021, 12:37pm UTC](https://discuss.elastic.co/t/conflicts-in-azure-fleet-integrations/283236/3 "2021-09-08T12:37:08Z")

</div>

@PhilA, thanks for brining this up, we need to check how those fields are defined in the ecs schema and make sure they are consistent over the integration. Feel free to create an issue on this, else I will create on based on this.

---

<div class="post-metadata">

**Author:** ![PhilA](https://avatars.discourse-cdn.com/v4/letter/p/c6cbf5/32.png) [@PhilA](https://discuss.elastic.co/u/PhilA)\
**Post date:** [September 8, 2021, 1:38pm UTC](https://discuss.elastic.co/t/conflicts-in-azure-fleet-integrations/283236/4 "2021-09-08T13:38:39Z")

</div>

Thanks @MarianaD, I have raised an issue:

[https://github.com/elastic/integrations/issues/1594](https://github.com/elastic/integrations/issues/1594)

Hopefully that is ok, I'm fairly new to Github

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 6, 2021, 3:39pm UTC](https://discuss.elastic.co/t/conflicts-in-azure-fleet-integrations/283236/5 "2021-10-06T15:39:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.