elastic / elastic/integrations

[Kibana]: Missing mapping type for HTTP headers in `kibana.audit`

Open
#15,837 0 comments 0 reactions 0 assignees View on GitHub
bug Feature:Stack Monitoring Integration:kibana needs:triage Team:Stack Monitoring
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Kibana [kibana]

### Dataset Name

`kibana.audit`

### Integration Version

All

### Agent Version

Any

### Agent Output Type

elasticsearch

### Elasticsearch Version

N/A

### OS Version and Architecture

-

### Software/API Version

-

### Error Message

1. HTTP request and response headers are not defined in ECS ([ongoing discussion](https://github.com/elastic/ecs/issues/232))
2. Most teams have settled on using `http.request.headers` and `http.response.headers`
3. The `kibana.log` data stream [defines](https://github.com/elastic/integrations/blob/main/packages/kibana/data_stream/log/fields/package-fields.yml#L1-L4) those fields as flattened
4. The `kibana.audit` data stream [doesn't define](https://github.com/elastic/integrations/blob/main/packages/kibana/data_stream/audit/fields/package-fields.yml) them

This discrepancy creates a mapping conflict for the `http.request.headers` field between the following two data streams
* In `.ds-logs-kibana.log-default-2025.10.21-000001` the field type is `flattened`
* In `.ds-logs-kibana.audit-default-2025.10.21-000001` the field type is `object`

### Event Original

-

### What did you do?

Nothing special, the discrepancy exists since the [initial PR](https://github.com/elastic/integrations/pull/1519/files).

### What did you see?

A mapping conflict when creating a data view in Kibana that spans both data streams.

### What did you expect to see?

The expectation is for `kibana.audit` to also explicitly define the mapping of the `http.request.headers` and `http.response.headers` fields.

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.