Failed in Fleet agent final_pipeline: field [created] not present as part of path [event.created]

[loganterfehr]

I was looking through sysmon logs from my switches and I noticed that there each log has an error.message field that states this:

Is there a mismatch of logs being ingested? Or is this not a big deal. Thanks ahead of time!

[reyesj2]

The elasticagent integration cisco_ios #12056 is included in the next release and will provide parsing for these logs.

Once the release is out and you upgrade you should be able to enable the integration and point your switch to send its logs to the port used by the integration (and update the firewall to also allow the integration port).