After pulling code with new winlogbeat ingest pipeline, go through dashboards to see what fields need to be changed.

[llwaterhouse]

[llwaterhouse]

There are some dashboards panels that were trying to access fields that didn't exist so those fields can be updated.

Then there other dashboard panels that used to work, but a field is now mapped to another field. For example, on the Computer Software Overview dashboard, the panel that is displaying a field called winlogbeat.event_data.OriginalFileName must be changed to display process.pe.original_file_name because winlogbeat changed the mapping of that field.