This is a mapping error, this means that in some of your documents you have a field named event
which is not an object. Since you are using elastic agent, it will use a pre-defined mapping (which you will not be able to change) where the event
field is an object.
For example, your documents probably have something like this:
{ "event": "value" }
But this will not be accepted as the event
field needs to be an object, what will be accepted is something like this:
{ "event": { "nestedfield": "value" }
You will need to change your json
processor to use the target_field
option and not add the fields to the root of the document to avoid conflicting your event
field with the agent event
field.
Which integration are you using? Can you share a sample of the document that give you this error?