diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index bcd071da69b..78b32ba932a 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -83,6 +83,7 @@ field. You can revert this change by configuring tags for the module and omittin
 - Update cloudwatch metricset mapping for both metrics and dimensions. {pull}15245[15245]
 - Make use of secure port when accessing Kubelet API {pull}16063[16063]
 - Move service config under metrics and simplify metric types. {pull}18691[18691]
+- Fix ECS compliance of user.id field in system/users  metricset {pull}19019[19019]
 
 *Packetbeat*
 
diff --git a/metricbeat/module/system/users/_meta/data.json b/metricbeat/module/system/users/_meta/data.json
index 5b96b10ba81..9db1f432d14 100644
--- a/metricbeat/module/system/users/_meta/data.json
+++ b/metricbeat/module/system/users/_meta/data.json
@@ -33,7 +33,7 @@
         }
     },
     "user": {
-        "id": 1000,
+        "id": "1000",
         "name": "alexk"
     }
 }
\ No newline at end of file
diff --git a/metricbeat/module/system/users/users.go b/metricbeat/module/system/users/users.go
index ff6ad38fa70..11064c67eb0 100644
--- a/metricbeat/module/system/users/users.go
+++ b/metricbeat/module/system/users/users.go
@@ -21,6 +21,7 @@ package users
 
 import (
 	"net"
+	"strconv"
 
 	"github.com/godbus/dbus"
 	"github.com/pkg/errors"
@@ -107,7 +108,7 @@ func eventMapping(conn *dbus.Conn, sessions []loginSession, report mb.ReporterV2
 			},
 			"user": common.MapStr{
 				"name": session.User,
-				"id":   session.UID,
+				"id":   strconv.Itoa(int(session.UID)),
 			},
 		}