Thank you for reviewing this and making the correction. I also have another topic related to this regarding the event metadata schema for a difference in input plugins log and filestream. The topic brings to light the difference in schema for the file path which in input log is log.file.path while in input filestream it is log.path. Here is a link to that topic Filebeat input types log and filestream metadata for file path/name differ