The type, channel, level, and normalized_message fields are not in the ECS schema and unsuitable for throttling the ECS pipeline. Current behavior will throttle the whole ECS pipeline uniformly as the key will render the same for every ECS-formatted event.