[8.13](backport #38780) [filebeat/netflow]: set event normalisation t…

…o true (#38802)

* [filebeat/netflow]: set event normalisation to true (#38780)

* fix(input/netflow): revert event normalisation to true for netflow input

* doc: update CHANGELOG.next.asciidoc

* fix: update fields.asciidoc (unrelated to this work)

* doc: remove irrelevant comment

(cherry picked from commit 2f5ee74)

* doc: remove irrelevant changes from CHANGELOG.next.asciidoc

---------

Co-authored-by: Panos Koutsovasilis <[email protected]>

CHANGELOG.next.asciidoc

@@ -74,6 +74,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Fix handling of Juniper SRX structured data when there is no leading junos element. {issue}36270[36270] {pull}36308[36308]
 - Fix Filebeat Cisco module with missing escape character {issue}36325[36325] {pull}36326[36326]
 - Added a fix for Crowdstrike pipeline handling process arrays {pull}36496[36496]
+- Fix indexing failures by re-enabling event normalisation in netflow input. {issue}38703[38703] {pull}38780[38780]
 
 *Heartbeat*
 

x-pack/filebeat/input/netflow/input.go

@@ -147,9 +147,7 @@ func (n *netflowInput) Run(context v2.Context, connector beat.PipelineConnector)
 	client, err := connector.ConnectWith(beat.ClientConfig{
 		PublishMode: beat.DefaultGuarantees,
 		Processing: beat.ProcessingConfig{
-			// This input only produces events with basic types so normalization
-			// is not required.
-			EventNormalization: boolPtr(false),
+			EventNormalization: boolPtr(true),
 		},
 		CloseRef:      context.Cancelation,
 		EventListener: nil,