Ignore failure for winlog.event_data.SubjectUserName rename processor. For some event ids (for example 4688), this field already been added in winlogbeat JS processor. Therefor, elastic throw [user.name] already exists error.
