Are you doing any additional parsing on the winlog data that is ingesting, such as adding additional fields? Its unusual that winlogbeat would create more than 100-200 fields, and even that is a lot. I’m not sure how that could add up to 1000+ fields. How many of the fields are prepended with winlogbeat_ ? Do you have a field list you can provide?