[text-auditor] Fix clear typos in user-facing docs, config comments, and runtime errors

Text Improvements

The following user-facing text issues were found in the repository. Each is a low-effort fix. Existing open [text-auditor] issues and /tmp/previous-findings.json were checked; already-tracked candidates such as shoud, duplicated for for, and Wether were excluded.

1. messsage should be message in Sophos XG field text

Files:

• x-pack/filebeat/module/sophos/xg/_meta/fields.yml (line 614)
• docs/reference/filebeat/exported-fields-sophos.md (line 930)
• filebeat/docs/fields.asciidoc (line 57508)

Current text: Signature messsage
Suggested fix: Signature message
Why: Clear spelling typo in an exported field description and generated docs.

2. Logstash output docs use the ungrammatical phrase allows to achieve

Files:

• libbeat/outputs/logstash/docs/logstash.asciidoc (line 304)
• docs/reference/auditbeat/logstash-output.md (line 151)
• docs/reference/filebeat/logstash-output.md (line 153)
• docs/reference/heartbeat/logstash-output.md (line 151)
• docs/reference/metricbeat/logstash-output.md (line 151)
• docs/reference/packetbeat/logstash-output.md (line 151)
• docs/reference/winlogbeat/logstash-output.md (line 151)

Current text: Specifying a TTL on the connection allows to achieve equal connection distribution between the instances.
Suggested fix: Specifying a TTL on the connection allows you to achieve equal connection distribution between the instances.
Why: Clear grammar error in user-facing output documentation.

3. Redis slow log config comments say pool instead of poll

Files:

• filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl (line 579)
• filebeat/filebeat.reference.yml (line 998)
• x-pack/filebeat/filebeat.reference.yml (line 2698)
• docs/reference/filebeat/filebeat-reference-yml.md (line 973)

Current text: List of hosts to pool to retrieve the slow log information.
Suggested fix: List of hosts to poll to retrieve the slow log information.
Why: Clear word typo in user-facing configuration comments.

4. Fileset generator error message has broken grammar

File: filebeat/generator/fileset/fileset.go (line 31)

Current text: module does not exist, please create module first by create-module command
Suggested fix: module does not exist, please create the module first with the create-module command
Why: Clear grammar error in a returned generator error message.

5. Module checklist uses the nonstandard plural criterias

File: .github/ISSUE_TEMPLATE/module-checklist.md (line 13)

Current text: For a metricset to go GA, the following criterias should be met:
Suggested fix: For a metricset to go GA, the following criteria should be met:
Why: criteria is already plural.

6. Filebeat reference docs typo messsages

File: docs/reference/filebeat/filebeat-reference-yml.md (line 782)

Current text: You can filter messsages in the parsers pipeline.
Suggested fix: You can filter messages in the parsers pipeline.
Why: Clear spelling typo in user-facing reference documentation.

7. Journald field mapping docs misspell and omit the actual field prefix

File: docs/reference/filebeat/filebeat-input-journald.md (line 493)

Current text: process.capabilites
Suggested fix: journald.process.capabilities
Why: capabilites is misspelled, and the code maps _CAP_EFFECTIVE to journald.process.capabilities in filebeat/input/journald/pkg/journalfield/default.go (line 49).

Suggested Actions

• Replace Signature messsage with Signature message in the Sophos XG field source and regenerate derived docs.
• Replace allows to achieve with allows you to achieve in the Logstash output docs source and generated references.
• Replace pool with poll in the Redis slow log host-list comment and regenerated references.
• Rewrite the fileset generator error message to include the module and with the create-module command.
• Replace criterias with criteria in the module checklist template.
• Replace messsages with messages in the Filebeat reference docs.
• Replace process.capabilites with journald.process.capabilities in the journald input mapping docs.

---

What is this? | From workflow: Text Auditor

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

• expires on Jun 29, 2026, 3:09 PM UTC

Start with the source files listed for the Sophos XG fields, Logstash output docs, Redis configuration templates, and the fileset generator, then compare their derived references. Check filebeat/input/journald/pkg/journalfield/default.go when correcting the journald field name. Replace the seven documented text issues and regenerate the affected references so all listed wording is consistent.