DataStream field is being replaced with a guid in elastic integration. How do I prevent that?

Data on target machine is stored in a ndjson logfile and is read by filebeat/elastic-agent then transferred to fleet server agent but the in the Elasticsearch index is no longer the original value stored in the ndjson source file. I have modified \agent\stream\stream.yml.hbs processors with copy_fields to but it returns the same guid not the original source data. I need the data to remain intact. How do I correct this issue?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.