I have several rules that come back as Failed after running. I'm getting the following error for many rules. The field names for the unknown column message varies among the different rules.
An error occurred during rule execution: message: "verification_exception
verification_exception: Found 2 problems
line 2:9: Unknown column [winlog.event_data.CallTrace]
line 12:6: Unknown column [winlog.event_data.TargetImage]"
I haven't looked at all the Failed rules yet, but so far, the ones I have looked at all depend on the Windows integration for the Elastic Agent. I look at the exported fields listed in the Windows integration and it includes both winlog.event_data.CallTrace and winlog.event_data.TargetImage but when I go to Stack Management > Data Views > logs-* and search on those fields, they are not listed.
Not sure why the Elastic Agent isn't passing these fields back. Some of the other fields referenced as unknown columns are:
I'm running on-prem enterprise licensed cluster at v8.11.2.