I'm having an issue where some rogue configuration is adding
cloud fields to the documents of one my indices. In particular, it looks like there is some
add_cloud_metadata: ~ processor running somewhere.
After much troubleshooting, I've confirmed that no index template or component template contains the
add_cloud_metadata: ~ processor.
However, I've discovered on the elastic agent itself, it seems the file
/opt/Elastic/Agent/data/elastic-agent-<ID>/data/install/filebeat-<VER>/filebeat.yml is applying
add_cloud_metadata: ~ config. Apart from commenting the line out directly, is there another way of managing this config, ideally from the Fleet Server itself (GUI or API)?