The plugin uses the (plain) codec (by default) but sets host and command fields directly on the event.

As these names conflict in ECS mode, the host.name and [process][command_line]? should be used with ecs_compatibility mode.