Skip internal fields on validation

Author: eric-forte-elastic

detection_rules/rule_validators.py

@@ -683,8 +683,12 @@ def validate_columns_index_mapping(
 
         for column in query_columns:
             column_name = column["name"]
+            # Skip Dynamic fields
             if column_name.startswith(("Esql.", "Esql_priv.")):
                 continue
+            # Skip internal fields
+            if column_name in ("_id", "_index", "_type"):
+                continue
             column_type = column["type"]
 
             # Check if the column exists in combined_mappings or a valid field generated from a function or operator