[7.x](backport #26627) [Filebeat] Remove alias fields from Suricata and Traefik module mappings

CHANGELOG.next.asciidoc

@@ -80,6 +80,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Change source field for `event.action` in `fortinet.firewall` module to `fortinet.firewall.action` instead of `fortinet.firewall.eventtype`. {pull}24816[24816]
 - Release Filebeat Stack Monitoring modules as GA {pull}26226[26226]
 - threatintel module: Changed the type of `threatintel.indicator.first_seen` from `keyword` to `date`. {pull}26765[26765]
+- Remove all alias fields pointing to ECS fields from modules. This affects the Suricata and Traefik modules. {issue}10535[10535] {pull}26627[26627]
 
 *Heartbeat*
 - Add support for screenshot blocks and use newer synthetics flags that only works in newer synthetics betas. {pull}25808[25808]

filebeat/docs/fields.asciidoc

@@ -143909,15 +143909,6 @@ type: keyword
 
 --
 
-*`suricata.eve.fileinfo.filename`*::
-+
---
-type: alias
-
-alias to: file.path
-
---
-
 *`suricata.eve.fileinfo.tx_id`*::
 +
 --
@@ -143960,65 +143951,20 @@ type: keyword
 
 --
 
-*`suricata.eve.fileinfo.size`*::
-+
---
-type: alias
-
-alias to: file.size
-
---
-
 *`suricata.eve.icmp_type`*::
 +
 --
 type: long
 
 --
 
-*`suricata.eve.dest_port`*::
-+
---
-type: alias
-
-alias to: destination.port
-
---
-
-*`suricata.eve.src_port`*::
-+
---
-type: alias
-
-alias to: source.port
-
---
-
-*`suricata.eve.proto`*::
-+
---
-type: alias
-
-alias to: network.transport
-
---
-
 *`suricata.eve.pcap_cnt`*::
 +
 --
 type: long
 
 --
 
-*`suricata.eve.src_ip`*::
-+
---
-type: alias
-
-alias to: source.ip
-
---
-
 
 *`suricata.eve.dns.type`*::
 +
@@ -144091,15 +144037,6 @@ type: keyword
 
 --
 
-*`suricata.eve.dest_ip`*::
-+
---
-type: alias
-
-alias to: destination.ip
-
---
-
 *`suricata.eve.icmp_code`*::
 +
 --
@@ -144108,83 +144045,20 @@ type: long
 --
 
 
-*`suricata.eve.http.status`*::
-+
---
-type: alias
-
-alias to: http.response.status_code
-
---
-
 *`suricata.eve.http.redirect`*::
 +
 --
 type: keyword
 
 --
 
-*`suricata.eve.http.http_user_agent`*::
-+
---
-type: alias
-
-alias to: user_agent.original
-
---
-
 *`suricata.eve.http.protocol`*::
 +
 --
 type: keyword
 
 --
 
-*`suricata.eve.http.http_refer`*::
-+
---
-type: alias
-
-alias to: http.request.referrer
-
---
-
-*`suricata.eve.http.url`*::
-+
---
-type: alias
-
-alias to: url.original
-
---
-
-*`suricata.eve.http.hostname`*::
-+
---
-type: alias
-
-alias to: url.domain
-
---
-
-*`suricata.eve.http.length`*::
-+
---
-type: alias
-
-alias to: http.response.body.bytes
-
---
-
-*`suricata.eve.http.http_method`*::
-+
---
-type: alias
-
-alias to: http.request.method
-
---
-
 *`suricata.eve.http.http_content_type`*::
 +
 --
@@ -144216,15 +144090,6 @@ type: keyword
 
 --
 
-*`suricata.eve.alert.severity`*::
-+
---
-type: alias
-
-alias to: event.severity
-
---
-
 *`suricata.eve.alert.rev`*::
 +
 --
@@ -144246,15 +144111,6 @@ type: keyword
 
 --
 
-*`suricata.eve.alert.action`*::
-+
---
-type: alias
-
-alias to: event.outcome
-
---
-
 *`suricata.eve.alert.signature_id`*::
 +
 --
@@ -145401,33 +145257,6 @@ type: keyword
 --
 
 
-*`suricata.eve.flow.bytes_toclient`*::
-+
---
-type: alias
-
-alias to: destination.bytes
-
---
-
-*`suricata.eve.flow.start`*::
-+
---
-type: alias
-
-alias to: event.start
-
---
-
-*`suricata.eve.flow.pkts_toclient`*::
-+
---
-type: alias
-
-alias to: destination.packets
-
---
-
 *`suricata.eve.flow.age`*::
 +
 --
@@ -145442,47 +145271,20 @@ type: keyword
 
 --
 
-*`suricata.eve.flow.bytes_toserver`*::
-+
---
-type: alias
-
-alias to: source.bytes
-
---
-
 *`suricata.eve.flow.reason`*::
 +
 --
 type: keyword
 
 --
 
-*`suricata.eve.flow.pkts_toserver`*::
-+
---
-type: alias
-
-alias to: source.packets
-
---
-
 *`suricata.eve.flow.alerted`*::
 +
 --
 type: boolean
 
 --
 
-*`suricata.eve.app_proto`*::
-+
---
-type: alias
-
-alias to: network.protocol
-
---
-
 *`suricata.eve.tx_id`*::
 +
 --
@@ -153375,15 +153177,6 @@ alias to: user_agent.original
 --
 
 
-*`traefik.access.user_agent.device`*::
-+
---
-type: alias
-
-alias to: user_agent.device.name
-
---
-
 *`traefik.access.user_agent.name`*::
 +
 --

filebeat/module/traefik/access/_meta/fields.yml

@@ -60,9 +60,6 @@
     - name: user_agent
       type: group
       fields:
-        - name: device
-          type: alias
-          path: user_agent.device.name
         - name: name
           type: alias
           path: user_agent.name