[text-auditor] Batch fix clear user-facing typo families in docs and field descriptions

[github-actions]

Text Improvements

The following user-facing text issues were found in the repository. Each is a low-effort, unambiguous fix.

1. Docs/extend typo batch in contributor-facing guidance

Why: Clear spelling errors in user-facing documentation.

• File: docs/extend/add-data-stream.md (line 31)
  Current text: 1. Boostrap a new data stream
  Suggested fix: 1. Bootstrap a new data stream
• File: docs/extend/add-mapping.md (line 60)
  Current text: An example of the aformentioned build.yml file for this method:
  Suggested fix: An example of the aforementioned build.yml file for this method:
• File: docs/extend/dashboard-guidelines.md (line 94)
  Current text: ... designing Kibana vizualizations.
  Suggested fix: ... designing Kibana visualizations.
• File: docs/extend/developer-workflow-import-beat.md (line 158)
  Current text: the field has mutliple values.
  Suggested fix: the field has multiple values.
• File: docs/extend/general-guidelines.md (line 62)
  Current text: ... better defaults when quering the data.
  Suggested fix: ... better defaults when querying the data.
• File: docs/extend/general-guidelines.md (line 75)
  Current text: ... when chosing dimensions:
  Suggested fix: ... when choosing dimensions:

2. identifer → identifier typo family (5 occurrences)

Why: Clear misspelling in user-visible field descriptions and generated docs.

• File: packages/m365_defender/data_stream/event/fields/fields.yml (line 24)
  Current text: The Microsoft Entra security identifer for the account.
  Suggested fix: The Microsoft Entra security identifier for the account.
• File: packages/m365_defender/docs/README.md (line 608)
  Current text: The Microsoft Entra security identifer for the account.
  Suggested fix: The Microsoft Entra security identifier for the account.
• File: packages/tychon/data_stream/systemcerts/fields/fields.yml (line 219)
  Current text: Subject Key identifer
  Suggested fix: Subject Key identifier
• File: packages/tychon/elasticsearch/transform/systemcerts/fields/fields.yml (line 219)
  Current text: Subject Key identifer
  Suggested fix: Subject Key identifier
• File: packages/tychon/docs/README.md (line 1671)
  Current text: Subject Key identifer
  Suggested fix: Subject Key identifier

3. wether → whether typo family (2 occurrences)

Why: Clear misspelling in user-facing description text.

• File: packages/sonicwall_firewall/data_stream/log/fields/package-fields.yml (line 30)
  Current text: Indicates wether a flow underwent Deep Packet Inspection.
  Suggested fix: Indicates whether a flow underwent Deep Packet Inspection.
• File: packages/sonicwall_firewall/docs/README.md (line 385)
  Current text: Indicates wether a flow underwent Deep Packet Inspection.
  Suggested fix: Indicates whether a flow underwent Deep Packet Inspection.

4. threshhold → threshold typo family (12 occurrences)

Why: Clear misspelling repeated in process cgroup memory field descriptions and generated docs.

• Files in source fields:
  • packages/system/data_stream/process/fields/fields.yml (lines 415, 419, 423, 473, 477, 481)
• Files in generated docs:
  • packages/system/docs/README.md (lines 1703, 1705, 1706, 1716, 1718, 1719)

Current text examples: memory low threshhold, memory high threshhold, memory max threshhold
Suggested fix: replace threshhold with threshold in all 12 occurrences.

5. Runtime log grammar issue in dry-run output

Why: User-visible log message has clear grammatical error.

• File: dev/testsreporter/github.go (line 38)
  Current text: DRY-RUN> not run command
  Suggested fix: DRY-RUN> command not run (or DRY-RUN> command was not run)

Suggested Actions

• Fix the six docs/extend typos listed above.
• Replace identifer with identifier in all 5 listed occurrences.
• Replace wether with whether in both listed occurrences.
• Replace threshhold with threshold in all 12 listed occurrences.
• Update the dry-run runtime log message in dev/testsreporter/github.go for grammatical correctness.

---

What is this? | From workflow: Text Auditor

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

• expires on Apr 23, 2026, 10:41 AM UTC