[azure.auditlogs] Incorrect Mapped type for 'log.level'

### Integration Name

Azure Logs [azure]

### Dataset Name

azure.auditlogs

### Integration Version

1.28.7

### Agent Version

8.18.8

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.18.8

### OS Version and Architecture

Rocky Linux 9 x86_64

### Software/API Version

_No response_

### Error Message

Error while parsing document for index [.ds-logs-azure.auditlogs-default-2025.12.18-000037]: [1:1633] failed to parse field [azure.auditlogs.level] of type [float] in document with id 'DTs_NpsB0I9EeWFKx-VG'. Preview of field's value: 'Informational'

### Event Original

_No response_

### What did you do?

{
"package": {
"name": "azure",
"version": "1.28.7"
},
"name": "azure-auditlogs-1",
"namespace": "",
"description": "",
"policy_ids": [
"832fb8b2-b91f-4ee4-bb30-924e27aa621e"
],
"output_id": null,
"vars": {
"eventhub": "[REDACTED]",
"consumer_group": "$Default",
"connection_string": {
"id": "[REDACTED]",
"isSecretRef": true
},
"storage_account": "[REDACTED]",
"storage_account_key": {
"id": "[REDACTED]",
"isSecretRef": true
}
},
"inputs": {
"eventhub-azure-eventhub": {
"enabled": false,
"streams": {
"azure.eventhub": {
"enabled": false,
"vars": {
"parse_message": false,
"preserve_original_event": false,
"data_stream.dataset": "azure.eventhub",
"tags": [
"azure-eventhub",
"forwarded"
],
"sanitize_newlines": false,
"sanitize_singlequotes": false
}
}
}
},
"adlogs-azure-eventhub": {
"enabled": true,
"streams": {
"azure.auditlogs": {
"enabled": true,
"vars": {
"preserve_original_event": false,
"tags": [
"azure-auditlogs",
"forwarded"
],
"sanitize_newlines": false,
"sanitize_singlequotes": false
}
},
"azure.identity_protection": {
"enabled": false,
"vars": {
"preserve_original_event": false,
"tags": [
"azure-identity-protection-logs",
"forwarded"
],
"sanitize_newlines": false,
"sanitize_singlequotes": false
}
},
"azure.provisioning": {
"enabled": false,
"vars": {
"preserve_original_event": false,
"tags": [
"azure-provisioning-logs",
"forwarded"
],
"sanitize_newlines": false,
"sanitize_singlequotes": false
}
},
"azure.signinlogs": {
"enabled": false,
"vars": {
"tags": [
"azure-signinlogs",
"forwarded"
],
"preserve_original_event": false,
"sanitize_newlines": false,
"sanitize_singlequotes": false
}
}
}
},
"platformlogs-azure-eventhub": {
"enabled": false,
"streams": {
"azure.platformlogs": {
"enabled": false,
"vars": {
"preserve_original_event": false,
"tags": [
"azure-platformlogs",
"forwarded"
],
"sanitize_newlines": false,
"sanitize_singlequotes": false
}
}
}
},
"activitylogs-azure-eventhub": {
"enabled": false,
"streams": {
"azure.activitylogs": {
"enabled": false,
"vars": {
"preserve_original_event": false,
"tags": [
"azure-activitylogs",
"forwarded"
],
"sanitize_newlines": false,
"sanitize_singlequotes": false
}
}
}
},
"springcloudlogs-azure-eventhub": {
"enabled": false,
"streams": {
"azure.springcloudlogs": {
"enabled": false,
"vars": {
"preserve_original_event": false,
"tags": [
"azure-springcloudlogs",
"forwarded"
],
"sanitize_newlines": false,
"sanitize_singlequotes": false
}
}
}
},
"firewall_logs-azure-eventhub": {
"enabled": false,
"streams": {
"azure.firewall_logs": {
"enabled": false,
"vars": {
"preserve_original_event": false,
"tags": [
"azure-firewall",
"forwarded"
],
"sanitize_newlines": false,
"sanitize_singlequotes": false
}
}
}
},
"application_gateway-azure-eventhub": {
"enabled": false,
"streams": {
"azure.application_gateway": {
"enabled": false,
"vars": {
"preserve_original_event": false,
"tags": [
"azure-application-gateway-logs",
"forwarded"
],
"sanitize_newlines": false,
"sanitize_singlequotes": false
}
}
}
},
"graphactivitylogs-azure-eventhub": {
"enabled": false,
"streams": {
"azure.graphactivitylogs": {
"enabled": false,
"vars": {
"preserve_original_event": false,
"tags": [
"azure-graphactivitylogs",
"forwarded"
],
"sanitize_newlines": false,
"sanitize_singlequotes": false
}
}
}
},
"events-azure-eventhub": {
"enabled": false,
"streams": {
"azure.events": {
"enabled": false,
"vars": {
"preserve_original_event": false,
"tags": [
"azure-eventhub",
"forwarded"
],
"sanitize_newlines": false,
"sanitize_singlequotes": false,
"processor_version": "v1",
"processor_update_interval": "10s",
"processor_start_position": "earliest",
"migrate_checkpoint": false,
"partition_receive_timeout": "5s",
"partition_receive_count": 100,
"endpoint_suffix": "core.windows.net"
}
}
}
}
}
}

### What did you see?

No logs parsed for integration after 2025/12/16

### What did you expect to see?

Logs successfully parsed (no connection issues and logs available in event hub)

### Anything else?

The issue appears to be in the field mapping of 'log.level' which according to the [map](https://github.com/elastic/integrations/blob/main/packages/azure/data_stream/auditlogs/fields/fields.yml) ought to be a float. As a string is parsed, the map causes an error in processing the pipeline. Manually altering the map to have log.level as type 'keyword' fixes the error, and events continue to be parsed.