Hello!
I think i found a problem - udp plugin add field host by default and breaks ECS.
Same issue Move the `host` field to a location in line with ECS or make it configurable · Issue #42 · logstash-plugins/logstash-input-udp · GitHub
Very bad behavior.
So, i think i found the solution - now (since this commit Make source IP field configurable by praseodym · Pull Request #43 · logstash-plugins/logstash-input-udp · GitHub) there is an option in UDP plugin.
Udp input plugin | Logstash Reference [8.11] | Elastic
So, i add a string to udp input block:
source_ip_fieldname => "host.ip"
Now it works, but i dont sure is this field name is best solution.