[Beats] Integration does not map agent.name

[philippkahr]

I have a policy with collect system metrics enabled, and I wondered why I couldn't filter in Kibana when using agent.name: "bla". Appears that we don't map agent.name. I believe this is related to this integration beats and quickly checking in the repo, I cannot find any agent mapping.

I suspect there are more integrations that do not adhere to the entire ECS catalog, yet index data that contains ECS fields.

This brings me back to one issue, where I mentioned that ES should be aware of all ECS fields and autodetect them, making sure that we would not need to have complex checks in place to ensure that the integration does not do stuff like this. elastic/elasticsearch#85146

[ruflin]

There is quite a list of related issues here:

• Optionally use ECS conventions for dynamic mappings elasticsearch#85692
• Using ECS fields in Elasticsearch indices / data streams ecs#1869

But the most important short term one is this one here: elastic/elastic-package#1018 As soon as dynamic mappings for the basic fields exist in packages, this "accidental" errors should not show up anymore.

[botelastic]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!