diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 1a84868343c1..7114d9659cee 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -74,6 +74,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Fix handling of Juniper SRX structured data when there is no leading junos element. {issue}36270[36270] {pull}36308[36308]
 - Fix Filebeat Cisco module with missing escape character {issue}36325[36325] {pull}36326[36326]
 - Added a fix for Crowdstrike pipeline handling process arrays {pull}36496[36496]
+- Fix indexing failures by re-enabling event normalisation in netflow input. {issue}38703[38703] {pull}38780[38780]
 
 *Heartbeat*
 
diff --git a/x-pack/filebeat/input/netflow/input.go b/x-pack/filebeat/input/netflow/input.go
index addd3d39c25d..26aa3927503e 100644
--- a/x-pack/filebeat/input/netflow/input.go
+++ b/x-pack/filebeat/input/netflow/input.go
@@ -147,9 +147,7 @@ func (n *netflowInput) Run(context v2.Context, connector beat.PipelineConnector)
 	client, err := connector.ConnectWith(beat.ClientConfig{
 		PublishMode: beat.DefaultGuarantees,
 		Processing: beat.ProcessingConfig{
-			// This input only produces events with basic types so normalization
-			// is not required.
-			EventNormalization: boolPtr(false),
+			EventNormalization: boolPtr(true),
 		},
 		CloseRef:      context.Cancelation,
 		EventListener: nil,