Filebeat CEF processor/module mapping exception for source.user.group

[adriansr]

For confirmed bugs, please report:

• Version: 7.4+
• Operating System: n/a
• Discuss Forum URL: https://discuss.elastic.co/t/filebeat-module-cef-syslog-parse-errors/220148/6
• In Stackexchange: https://unix.stackexchange.com/questions/546623/elastic-stack-7-4-0-filebeat-cef-module-mapper-parsing-exception
• Steps to Reproduce:

Indexing any CEF event with the sourceUserPrivileges(spriv) or destinationUserPrivileges (dpriv) extensions will cause an index error:

Cannot index event [...] (status=400): {"type":"mapper_parsing_exception","reason":"object mapping for [source.user.group] tried to parse field [group] as object, but found a concrete value"}

Because those fields are mapped to source.user.group and destination.user.group, which are objects under ECS. The correct mapping would be source.user.group.name and destination.user.group.name.

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)