Filebeat o365 module field type inconsistency

Elastic Stack Beats
1

Hi,

I've been using the O365 module in FileBeat for a while now, and I've noticed that when the O365 module outputs the o365.audit.AdditionalInfo field, sometimes it's as a JSON string, and sometimes it's as an object. This has resulted in my Elastic O365 daily indexes having a mix of keyword and Object types for this field.

Has anyone else seen this? Is this a bug, or...?
I've seen this with FB versions 7.17(.7?) and 8.12.0

Thanks,

 - Daniel
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.