m365_defender ingest pipeline failed event.original already exists

[ThomSwiss]

The elastic ingest pipelines from the integration m365_defender fails, when I get the data over logstash.

Works: Elastic-Agent with m365_defender integration, Output Elasticsearch
Doesn't work: Elastic-Agent with m365_defender integration, Output Logstash. The ingest pipeline stops working with this error.message:
field [event.original] already exists

Reason: Logstash adds the field event.original which is already similar to the field message after processing with logstash.

Problem in pipeline logs-m365_defender.incident-2.2.0 :

  {
    "rename": {
      "field": "message",
      "target_field": "event.original",
      "tag": "rename_message_to_event_original",
      "ignore_missing": true
    }
  }

Possible fix:

    {
      "rename": {
        "field": "message",
        "target_field": "event.original",
        "ignore_missing": true,
        "tag": "rename_message_to_event_original",
        "ignore_failure": true
      }
    }

The problem could also exist in so some other pipeleline. Please check as well

logs-m365_defender.event
logs-m365_defender.event-2.2.0-pipeline_alert 
logs-m365_defender.event-2.2.0-pipeline_app_and_identity 
logs-m365_defender.event-2.2.0-pipeline_device 
logs-m365_defender.event-2.2.0-pipeline_email 
logs-m365_defender.incident-2.2.0 
logs-m365_defender.log-2.2.0

[bhapas]

Relates #3451

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)