I'm getting the following error out of logstash:
"reason"=>"Could not dynamically add mapping for field [user.name]. Existing mapping for [user] must be of type object but found [text]."}}}}
I've found another 2 forum posts that had no follow up (from the user) so I was unable to determine the correct fix.
I understand that the mapping in Elastic is different than what Logstash is attempting to Index. In this case I'm attempting to rename => user_name to user.name to be ECS compliant. What else needs to be done to make sure the the field is being indexed correctly?