elastic / elastic/integrations
[Kibana]: Missing mapping type for HTTP headers in `kibana.audit`
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
Kibana [kibana]
### Dataset Name
`kibana.audit`
### Integration Version
All
### Agent Version
Any
### Agent Output Type
elasticsearch
### Elasticsearch Version
N/A
### OS Version and Architecture
-
### Software/API Version
-
### Error Message
1. HTTP request and response headers are not defined in ECS ([ongoing discussion](https://github.com/elastic/ecs/issues/232))
2. Most teams have settled on using `http.request.headers` and `http.response.headers`
3. The `kibana.log` data stream [defines](https://github.com/elastic/integrations/blob/main/packages/kibana/data_stream/log/fields/package-fields.yml#L1-L4) those fields as flattened
4. The `kibana.audit` data stream [doesn't define](https://github.com/elastic/integrations/blob/main/packages/kibana/data_stream/audit/fields/package-fields.yml) them
This discrepancy creates a mapping conflict for the `http.request.headers` field between the following two data streams
* In `.ds-logs-kibana.log-default-2025.10.21-000001` the field type is `flattened`
* In `.ds-logs-kibana.audit-default-2025.10.21-000001` the field type is `object`
### Event Original
-
### What did you do?
Nothing special, the discrepancy exists since the [initial PR](https://github.com/elastic/integrations/pull/1519/files).
### What did you see?
A mapping conflict when creating a data view in Kibana that spans both data streams.
### What did you expect to see?
The expectation is for `kibana.audit` to also explicitly define the mapping of the `http.request.headers` and `http.response.headers` fields.
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.