I've been using the O365 module in FileBeat for a while now, and I've noticed that when the O365 module outputs the o365.audit.AdditionalInfo field, sometimes it's as a JSON string, and sometimes it's as an object. This has resulted in my Elastic O365 daily indexes having a mix of keyword and Object types for this field.
Has anyone else seen this? Is this a bug, or...?
I've seen this with FB versions 7.17(.7?) and 8.12.0