commenting the below section out in the ingest/pipeline.yml gets me passed the errors and filebeat starts properly finally
#- split:
# field: cisco.umbrella.identities
# separator: ","
# preserve_trailing: false
# if: "ctx?.log?.file?.path.contains('dnslogs') && ctx?.cisco?.umbrella?.identities != null"