Integration field map error, how to fix temporarily

[rugenl (Len Rugen)]

In the Microsoft Exchange integration, message tracking, field relatedrecipeinetaddress is mapped as an IP, but it is really an email address. I've reported a bug, but until it's fixed, what is the best way to fix this?

I can just change the field in the component template logs-microsoft_exchange_server.messagetracking@package, but that I wonder if there is a method to add custom mappings? If I change this template, will it get over written at update? If I change the mapping, will it cause a mapping conflict in Kibana? Another option would be to add a .text and maybe also a .keyword field.

Just trying to avoid the typical elastic learning by painful choices path
Thanks.

[stephenb (Stephen Brown)]

@rugenl

You can use the @custom component template

Data streams | Fleet and Elastic Agent Guide [8.15] | Elastic

Should be

logs-microsoft_exchange_server.messagetracking@custom

Although as the note says it is really recommended to change mappings but in this case I would try

[rugenl (Len Rugen)]

It doesn't look like the exchange_server integration created any @custom component templates.

[stephenb (Stephen Brown)]

Hi @rugenl

You have to create it...

If you look in the top template you should see it included but you have to create it... then it will be included

logs-microsoft_exchange_server.messagetracking@custom