Hi guys, adapting our integration (Wazuh) for Elastic 7.0 I've noticed that Filebeat is using a field named "agent" which is in conflict with our field "agent". Our events have agent.id, agent.name along other agent.* fields.
Is there a way to rename the Filebeat fields to filebeat-agent or something else? If so, It may break something related to the Elastic stack? What's the best solution from your view?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.