conflict in field name type

[Harsh Godiwala]

 When wazuh agent collect from endpoint and enter in index so seen some conflict like in below image

how to i solve this

Then i check in my index pattern so data.EventCount shows conflit it's in below image:

and also it shows reason

How to solve this?

[musbau....@wazuh.com]

The images you attached shows the conflict in data.EventCount is happening because different indices within your my-custom-alerts* pattern have assigned different data types to that specific field. one as an integer and another as a keyword. It is preventing Wazuh from aggregating or visualizing the data correctly. You should update your index template to strictly define data.EventCount as an integer.so it ensures that every new index created by the Wazuh agent follows the same schema, preventing new conflicts from arising. For your existing data, You can reindex the affected indices. Once the reindexing is complete and you have deleted the old indices with the conflicting types, refresh your index pattern in the Wazuh dashboard.

You can reference this below.

https://documentation.wazuh.com/current/user-manual/wazuh-indexer/re-indexing.html
https://documentation.wazuh.com/current/user-manual/wazuh-indexer/wazuh-indexer-indices.html