[text-auditor] Fix clear docs and field text grammar typos

## Text Improvements

The following user-facing text issues were found in the repository. Each is a low-effort fix. Existing `/tmp/previous-findings.json` entries and current open `[text-auditor]` issues were checked; already-tracked candidates such as GCP metrics grammar, `defaut`, `messsage`, `Show modules information`, and `a Elasticsearch` were excluded.

### 1. Azure Blob Storage docs use `service principle` instead of `service principal`

**File:** `docs/reference/filebeat/filebeat-input-azure-blob-storage.md` (line 174)
**Current text:** `According to our internal testing it seems that we require at least an access level of **blobOwner** for the service principle to be able to read the blobs.`
**Suggested fix:** `According to our internal testing it seems that we require at least an access level of **blobOwner** for the service principal to be able to read the blobs.`
**Why:** `service principal` is the correct Azure identity term.

### 2. Filebeat troubleshooting docs say `is disable by default`

**File:** `docs/reference/filebeat/filebeat-not-collecting-lines.md` (line 14)
**Current text:** `` `ignore_older` is disable by default so this depends on the value you have set. ``
**Suggested fix:** `` `ignore_older` is disabled by default so this depends on the value you have set. ``
**Why:** Clear verb-form grammar error.

### 3. Monitoring configuration docs use incorrect subject-verb agreement

**Files:**
- `docs/reference/auditbeat/configuration-monitor.md` (line 105)
- `docs/reference/filebeat/configuration-monitor.md` (line 105)
- `docs/reference/heartbeat/configuration-monitor.md` (line 105)
- `docs/reference/metricbeat/configuration-monitor.md` (line 105)
- `docs/reference/packetbeat/configuration-monitor.md` (line 105)
- `docs/reference/winlogbeat/configuration-monitor.md` (line 105)

**Current text:** `The time interval (in seconds) when state information are sent to the {{es}} cluster.`
**Suggested fix:** `The time interval (in seconds) when state information is sent to the {{es}} cluster.`
**Why:** `information` is singular, so the verb should be `is`.

### 4. Socket dataset docs have grammar and possessive errors

**Files:**
- `x-pack/auditbeat/module/system/socket/_meta/docs.md` (line 6)
- `docs/reference/auditbeat/auditbeat-dataset-system-socket.md` (line 18)

**Current text:** `It allows to monitor network traffic to and from running processes. It’s main features are:`
**Suggested fix:** `It allows you to monitor network traffic to and from running processes. Its main features are:`
**Why:** The sentence is missing the object after `allows`, and `Its` should be the possessive form.

### 5. Sync Gateway docs use `allows to monitor`

**Files:**
- `x-pack/metricbeat/module/syncgateway/_meta/docs.md` (line 6)
- `docs/reference/metricbeat/metricbeat-module-syncgateway.md` (line 18)

**Current text:** `This metricset allows to monitor a Sync Gateway instance by using its REST API.`
**Suggested fix:** `This metricset allows you to monitor a Sync Gateway instance by using its REST API.`
**Why:** The sentence is missing the object after `allows`.

### 6. Packetbeat Redis docs use `allows to use request pipelining`

**File:** `docs/reference/packetbeat/packetbeat-redis-options.md` (line 29)
**Current text:** `which allows to use request pipelining while at the same time limiting the amount of memory consumed by replication sessions.`
**Suggested fix:** `which allows request pipelining while at the same time limiting the amount of memory consumed by replication sessions.`
**Why:** Clear grammar error in user-facing configuration documentation.

### 7. Auditd field description spells `fingerprint` as two words

**Files:**
- `auditbeat/module/auditd/_meta/fields.yml` (line 335)
- `docs/reference/auditbeat/exported-fields-auditd.md` (line 518)

**Current text:** `crypto key finger print`
**Suggested fix:** `crypto key fingerprint`
**Why:** `fingerprint` is the standard spelling for this term.

### 8. AWS Health field description uses the wrong article

**Files:**
- `x-pack/metricbeat/module/aws/awshealth/_meta/fields.yml` (line 66)
- `docs/reference/metricbeat/exported-fields-aws.md` (line 148)

**Current text:** `Information about an entity affected by a AWS Health event.`
**Suggested fix:** `Information about an entity affected by an AWS Health event.`
**Why:** `AWS` is pronounced with an initial vowel sound, so the article should be `an`.

### 9. ETW field description says `This keywords are`

**Files:**
- `x-pack/filebeat/input/etw/_meta/fields.yml` (line 71)
- `docs/reference/filebeat/exported-fields-winlog.md` (line 68)

**Current text:** `This keywords are a list of keywords, each keyword is a string that represents a specific keyword.`
**Suggested fix:** `These keywords are a list of keywords, each keyword is a string that represents a specific keyword.`
**Why:** Clear demonstrative/pronoun agreement error.

### 10. MSSQL field description uses incorrect verb agreement

**Files:**
- `x-pack/metricbeat/module/mssql/_meta/fields.yml` (line 12)
- `docs/reference/metricbeat/exported-fields-mssql.md` (line 21)

**Current text:** `The database that the metrics is being referred to`
**Suggested fix:** `The database that the metrics refer to`
**Why:** `metrics` is plural, so the verb should agree.

### 11. NATS field description is missing `that`

**Files:**
- `filebeat/module/nats/log/_meta/fields.yml` (line 49)
- `docs/reference/filebeat/exported-fields-nats.md` (line 80)
- `filebeat/docs/fields.asciidoc` (line 41416)

**Current text:** `Details about the error occurred`
**Suggested fix:** `Details about the error that occurred`
**Why:** Clear broken sentence construction.

### 12. PAN-OS field descriptions have article and spacing errors

**Files:**
- `x-pack/filebeat/module/panw/panos/_meta/fields.yml` (lines 180 and 190)
- `docs/reference/filebeat/exported-fields-panw.md` (lines 218 and 230)
- `filebeat/docs/fields.asciidoc` (lines 53505 and 53525)

**Current text:** `A string showing that error that has occurred in any event.`
**Suggested fix:** `A string showing the error that has occurred in any event.`
**Why:** Clear article error.

**Current text:** `The number of sessions with the same source IP address, destination IP address, application, and subtype that GlobalProtect has detected within the last five seconds.An integer associated with any errors that occurred.`
**Suggested fix:** `The number of sessions with the same source IP address, destination IP address, application, and subtype that GlobalProtect has detected within the last five seconds. An integer associated with any errors that occurred.`
**Why:** Missing sentence space in exported field text.

## Suggested Actions

- [ ] Replace `service principle` with `service principal` in the Azure Blob Storage input docs.
- [ ] Replace `is disable by default` with `is disabled by default` in the Filebeat troubleshooting docs.
- [ ] Fix `state information are sent` in all six monitoring configuration reference docs.
- [ ] Fix the `allows to monitor` and `It’s main` grammar in the socket dataset docs source and generated reference.
- [ ] Fix `allows to monitor` in the Sync Gateway docs source and generated reference.
- [ ] Fix `allows to use request pipelining` in the Packetbeat Redis options docs.
- [ ] Replace `finger print` with `fingerprint` in the auditd field description and generated docs.
- [ ] Replace `a AWS Health event` with `an AWS Health event` in the AWS Health field description and generated docs.
- [ ] Replace `This keywords are` with `These keywords are` in the ETW field description and generated docs.
- [ ] Fix the MSSQL field description so `metrics` takes a plural verb.
- [ ] Add `that` to `Details about the error occurred` in the NATS field description and generated docs.
- [ ] Fix the PAN-OS article typo and missing sentence space in the field source and generated docs.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Text Auditor](https://github.com/elastic/beats/actions/runs/28448748050)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Jul 7, 2026, 1:51 PM UTC

Review the source field metadata and documentation files listed for each finding, including the Beats docs and module _meta fields. Apply the specified grammar and spelling corrections in both source and generated reference files where listed. Done means all twelve checklist items are corrected consistently across the named files.

Written by the indexing model from the issue text.