Why can't I use user.name as field in machine learning job, but the standard jobs can?

This is the output:

{ }

I am using winlogbeat though