Filebeat o365 module - Parsing o365.audit.data field

Elastic Stack Beats
2

I think that using a script processor for this fields is not a bad idea. You can give a try to JSON processor (ingest node): https://www.elastic.co/guide/en/elasticsearch/reference/current/json-processor.html