diff --git a/filebeat/module/apache2/access/ingest/default.json b/filebeat/module/apache2/access/ingest/default.json
index 6fb3a4f0d57d..d3eef903b4ec 100644
--- a/filebeat/module/apache2/access/ingest/default.json
+++ b/filebeat/module/apache2/access/ingest/default.json
@@ -33,7 +33,8 @@
     "user_agent": {
       "field": "apache2.access.agent",
       "target_field": "apache2.access.user_agent",
-      "ignore_failure": true
+      "ignore_failure": true,
+      "ecs": false
     }
   }, {
     "rename": {
diff --git a/filebeat/module/iis/access/ingest/default.json b/filebeat/module/iis/access/ingest/default.json
index 350b71dc922f..1c8d20433754 100644
--- a/filebeat/module/iis/access/ingest/default.json
+++ b/filebeat/module/iis/access/ingest/default.json
@@ -33,7 +33,8 @@
   }, {
     "user_agent": {
       "field": "iis.access.agent",
-      "target_field": "iis.access.user_agent"
+      "target_field": "iis.access.user_agent",
+      "ecs": false
     }
   }, {
     "rename": {
diff --git a/filebeat/module/nginx/access/ingest/default.json b/filebeat/module/nginx/access/ingest/default.json
index ebecb15f5a46..e261b5770d36 100644
--- a/filebeat/module/nginx/access/ingest/default.json
+++ b/filebeat/module/nginx/access/ingest/default.json
@@ -73,7 +73,8 @@
         {
             "user_agent": {
                 "field": "nginx.access.agent",
-                "target_field": "nginx.access.user_agent"
+                "target_field": "nginx.access.user_agent",
+                "ecs": false
             }
         },
         {
diff --git a/filebeat/module/traefik/access/ingest/pipeline.json b/filebeat/module/traefik/access/ingest/pipeline.json
index c348d0475847..d5c2848f245c 100644
--- a/filebeat/module/traefik/access/ingest/pipeline.json
+++ b/filebeat/module/traefik/access/ingest/pipeline.json
@@ -46,7 +46,8 @@
             "user_agent": {
                 "field": "traefik.access.agent",
                 "target_field": "traefik.access.user_agent",
-                "ignore_failure": true
+                "ignore_failure": true,
+                "ecs": false
             }
         },
         {
diff --git a/x-pack/filebeat/module/suricata/eve/ingest/pipeline.json b/x-pack/filebeat/module/suricata/eve/ingest/pipeline.json
index 479990a24c1f..77f0996eee45 100644
--- a/x-pack/filebeat/module/suricata/eve/ingest/pipeline.json
+++ b/x-pack/filebeat/module/suricata/eve/ingest/pipeline.json
@@ -207,6 +207,7 @@
       { "field": "user_agent.original"
       , "target_field": "user_agent"
       , "ignore_missing": true
+      , "ecs": false
       }
     }
   , { "rename":