Ok I tried dropping it from filebeat but it doesn't seem to work anyone has an idea as to way this config fails:
processors:
- drop_fields:
when:
equals
fields: ["agent.ephemeral_id", "agent.hostname", "agent.id", "agent.type", "agent.version", "ecs.version", "input.type", "log.offset"]
from filebeat.yml