elastic / elastic/integrations
[System]: error in system.auth ingest pipeline due to existing message field
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
### Integration Name
System [system]
### Dataset Name
system.auth
### Integration Version
2.7.1
### Agent Version
9.2.1
### Agent Output Type
elasticsearch
### Elasticsearch Version
9.2.1
### OS Version and Architecture
Debian
### Software/API Version
_No response_
### Error Message
Processor rename with tag "" failed with message 'field [message] already exists'
### Event Original
_No response_
### What did you do?
The integration was configured with a processor to capture an environment variable.
### What did you see?
An error.message for all documents in the system.auth dataset
### What did you expect to see?
No error.message, and a condition in the processor on the existence of a message field
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.