elastic / elastic/integrations

[System]: error in system.auth ingest pipeline due to existing message field

Open
#16,062 2 comments 0 reactions 0 assignees View on GitHub
Integration:system needs:triage Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

### Integration Name

System [system]

### Dataset Name

system.auth

### Integration Version

2.7.1

### Agent Version

9.2.1

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.2.1

### OS Version and Architecture

Debian

### Software/API Version

_No response_

### Error Message

Processor rename with tag "" failed with message 'field [message] already exists'

### Event Original

_No response_

### What did you do?

The integration was configured with a processor to capture an environment variable.

### What did you see?

An error.message for all documents in the system.auth dataset

### What did you expect to see?

No error.message, and a condition in the processor on the existence of a message field

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.