diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 70db82fc6..861f6b02c 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1176,6 +1176,10 @@ soc:
         -  logdata.USERNAME
         -  logdata.USERAGENT
         -  event.dataset
+      ':elastic_agent:':
+        -  soc_timestamp
+        -  event.dataset
+        -  message
     server:
       bindAddress: 0.0.0.0:9822
       baseUrl: /