Fix duplicated-word typos and awkward CLI help phrase in user-facing text

[Copilot]

Fixes several duplicated-word typos and one unidiomatic phrase caught by the text auditor.

• Docs: Remove the the → the in filebeat-input-container.md, filebeat-input-log.md, filebeat-input-http_endpoint.md
• Docs: Remove of of → of in exported-fields-system.md
• CLI: Capitalize error creating file handler → Error creating file handler in libbeat/cmd/export/template.go and ilm_policy.go for consistency with adjacent fatal messages
• CLI: Replace by the moment → for now in libbeat/cmd/completion.go

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[text-auditor] Fix duplicated-word typos and one awkward CLI help phrase in user-facing text</issue_title>
<issue_description>## Text Improvements

The following user-facing text issues were found in the repository. Each is a low-effort fix.

1. Duplicate word in Filebeat container input docs

File: docs/reference/filebeat/filebeat-input-container.md (line 15)
Current text: Please use the the [\filestream`](/reference/filebeat/filebeat-input-filestream.md) input... **Suggested fix:**Please use the `filestream` input... **Why:** Clear typo (the the`) in user-facing documentation.

2. Duplicate word in Filebeat log input docs

File: docs/reference/filebeat/filebeat-input-log.md (line 15)
Current text: Please use the the [\filestream`](/reference/filebeat/filebeat-input-filestream.md) input... **Suggested fix:**Please use the `filestream` input... **Why:** Clear typo (the the`) in user-facing documentation.

3. Duplicate words in HTTP endpoint input docs

File: docs/reference/filebeat/filebeat-input-http_endpoint.md (line 13)
Current text: ...expression that converts the the JSON body...
Suggested fix: ...expression that converts the JSON body...
Why: Clear grammar typo (the the) in user-facing documentation.

4. Duplicate words in exported fields docs

File: docs/reference/metricbeat/exported-fields-system.md (line 472)
Current text: The total number of of milliseconds spent doing I/Os.
Suggested fix: The total number of milliseconds spent doing I/Os.
Why: Clear typo (of of) in user-facing exported fields text.

5. Inconsistent capitalization in fatal error output

File: libbeat/cmd/export/template.go (line 52), libbeat/cmd/export/ilm_policy.go (line 50)
Current text: error creating file handler: %s
Suggested fix: Error creating file handler: %s
Why: User-facing fatal errors in same command surface are otherwise capitalized (Error exporting ...), making this an unambiguous consistency fix.

6. Awkward CLI help phrase

File: libbeat/cmd/completion.go (line 32)
Current text: Output shell completion code for the specified shell (bash and zsh only by the moment)
Suggested fix: Output shell completion code for the specified shell (bash and zsh only for now)
Why: User-facing help text uses unidiomatic phrasing; correction is clear and low-effort.

Suggested Actions

• Remove duplicated words in docs/reference/filebeat/filebeat-input-container.md and docs/reference/filebeat/filebeat-input-log.md.
• Remove duplicated words in docs/reference/filebeat/filebeat-input-http_endpoint.md and docs/reference/metricbeat/exported-fields-system.md.
• Capitalize error creating file handler in both export command files for consistency.
• Replace by the moment with for now in CLI completion help text.

---

What is this? | From workflow: Text Auditor

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

• expires on Mar 11, 2026, 1:36 PM UTC

Comments on the Issue (you are @copilot in this section)

• Fixes [text-auditor] Fix duplicated-word typos and one awkward CLI help phrase in user-facing text #49267

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @Copilot? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[github-actions]

Vale Linting Results

Summary: 5 warnings, 2 suggestions found

⚠️ Warnings (5)

File	Line	Rule	Message
docs/reference/filebeat/filebeat-input-container.md	13	Elastic.DontUse	Don't use 'just'.
docs/reference/filebeat/filebeat-input-container.md	15	Elastic.DontUse	Don't use 'Please'.
docs/reference/filebeat/filebeat-input-container.md	17	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
docs/reference/filebeat/filebeat-input-log.md	15	Elastic.DontUse	Don't use 'Please'.
docs/reference/filebeat/filebeat-input-log.md	17	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.

💡 Suggestions (2)

File	Line	Rule	Message
docs/reference/filebeat/filebeat-input-container.md	13	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
docs/reference/filebeat/filebeat-input-log.md	13	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

🔍 Preview links for changed docs

• docs/reference/filebeat/filebeat-input-container.md
• docs/reference/filebeat/filebeat-input-http_endpoint.md
• docs/reference/filebeat/filebeat-input-log.md
• docs/reference/metricbeat/exported-fields-system.md

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6df149b2-ebc5-4a31-a6fc-af97ec261a58

📥 Commits

Reviewing files that changed from the base of the PR and between bb195e8 and fec3082.

⛔ Files ignored due to path filters (1)

• x-pack/filebeat/input/netflow/decoder/fields/ipfix-information-elements.csv is excluded by !**/*.csv

📒 Files selected for processing (37)

• docs/extend/build-dashboards.md
• docs/reference/auditbeat/exported-fields-ecs.md
• docs/reference/filebeat/exported-fields-ecs.md
• docs/reference/filebeat/filebeat-module-mysqlenterprise.md
• docs/reference/filebeat/filebeat-reference-yml.md
• docs/reference/heartbeat/exported-fields-ecs.md
• docs/reference/heartbeat/monitor-http-options.md
• docs/reference/metricbeat/exported-fields-ecs.md
• docs/reference/metricbeat/exported-fields-haproxy.md
• docs/reference/metricbeat/metricbeat-metricset-iis-application_pool.md
• docs/reference/metricbeat/metricbeat-metricset-iis-webserver.md
• docs/reference/metricbeat/metricbeat-module-http.md
• docs/reference/metricbeat/metricbeat-module-iis.md
• docs/reference/metricbeat/metricbeat-reference-yml.md
• docs/reference/metricbeat/monitoring-metricbeat-collection.md
• docs/reference/packetbeat/exported-fields-ecs.md
• docs/reference/winlogbeat/exported-fields-ecs.md
• docs/reference/winlogbeat/load-ingest-pipelines.md
• filebeat/docs/fields.asciidoc
• filebeat/docs/modules/mysqlenterprise.asciidoc
• filebeat/filebeat.reference.yml
• filebeat/module/santa/_meta/config.yml
• filebeat/modules.d/santa.yml.disabled
• heartbeat/docs/fields.asciidoc
• libbeat/_meta/fields.ecs.yml
• metricbeat/metricbeat.reference.yml
• metricbeat/module/http/_meta/config.yml
• metricbeat/module/system/diskio/_meta/fields.yml
• metricbeat/modules.d/http.yml.disabled
• packetbeat/docs/fields.asciidoc
• x-pack/filebeat/filebeat.reference.yml
• x-pack/filebeat/module/mysqlenterprise/_meta/docs.md
• x-pack/metricbeat/metricbeat.reference.yml
• x-pack/metricbeat/module/iis/_meta/docs.md
• x-pack/metricbeat/module/iis/application_pool/_meta/docs.md
• x-pack/metricbeat/module/iis/webserver/_meta/docs.md
• x-pack/osquerybeat/docs/fields.asciidoc

✅ Files skipped from review due to trivial changes (26)

• filebeat/docs/fields.asciidoc
• libbeat/_meta/fields.ecs.yml
• filebeat/modules.d/santa.yml.disabled
• filebeat/filebeat.reference.yml
• docs/reference/metricbeat/metricbeat-metricset-iis-application_pool.md
• docs/reference/winlogbeat/load-ingest-pipelines.md
• docs/reference/filebeat/filebeat-module-mysqlenterprise.md
• docs/reference/filebeat/exported-fields-ecs.md
• docs/reference/winlogbeat/exported-fields-ecs.md
• filebeat/module/santa/_meta/config.yml
• x-pack/metricbeat/module/iis/webserver/_meta/docs.md
• filebeat/docs/modules/mysqlenterprise.asciidoc
• metricbeat/metricbeat.reference.yml
• metricbeat/modules.d/http.yml.disabled
• x-pack/metricbeat/module/iis/application_pool/_meta/docs.md
• docs/reference/auditbeat/exported-fields-ecs.md
• x-pack/filebeat/module/mysqlenterprise/_meta/docs.md
• docs/reference/metricbeat/metricbeat-reference-yml.md
• x-pack/metricbeat/module/iis/_meta/docs.md
• docs/reference/metricbeat/exported-fields-ecs.md
• docs/reference/metricbeat/metricbeat-metricset-iis-webserver.md
• docs/reference/metricbeat/metricbeat-module-http.md
• docs/extend/build-dashboards.md
• docs/reference/filebeat/filebeat-reference-yml.md
• docs/reference/heartbeat/monitor-http-options.md
• metricbeat/module/http/_meta/config.yml

---

📝 Walkthrough

Walkthrough

This PR applies numerous textual and formatting edits across documentation and CLI help/error strings. Changes include fixing duplicated words and minor typos in many exported-fields and module docs, small formatting cleanup in asciidoc/YAML comments, an added example for HTTP monitor body matching, capitalization of two error messages in libbeat export commands, rewording the completion command help, and a large change that replaces a previously commented Salesforce module template with an active configuration in x-pack/filebeat/filebeat.reference.yml. No code behavior or control-flow changes were made.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	All code changes align with the six requirements from issue #49267: duplicate word fixes in three Filebeat docs files, one Metricbeat file, error message capitalization in two export command files, and CLI help text improvement.
Out of Scope Changes check	✅ Passed	Changes are limited to fixing user-facing text issues (duplicated words, capitalization, phrasing) as specified in issue #49267, with no unrelated modifications.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch copilot/fix-duplicated-word-typos

• 🛠️ Update Documentation: Commit on current branch
• 🛠️ Update Documentation: Create PR

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[github-actions]

Checked workflow run 22827629972 for this PR and there were no failed checks.

• Run: check-default (conclusion: success)
• Job: check (id: 66210446644, conclusion: success)
• Failed jobs/steps found: none

Root cause analysis: not applicable because the run completed successfully.
Recommended remediation: none required.
Tests observed from Actions: check-default completed successfully on ubuntu-latest.

---

What is this? | From workflow: PR Actions Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

The failure is caused by golangci-lint in lint (ubuntu-latest), not by the typo/doc edits themselves. In step 5_golangci-lint, the run reports 4 issues in libbeat/cmd/completion.go:

• libbeat/cmd/completion.go:43:30 and :45:29 (errcheck): return values from rootCmd.GenBashCompletion / rootCmd.GenZshCompletion are unchecked.
• libbeat/cmd/completion.go:37:5 and :47:5 (forbidigo): fmt.Println / fmt.Printf are forbidden.

Root cause: this PR modifies libbeat/cmd/completion.go (--whole-files + only-new-issues), so existing lint violations in that file are now surfaced as PR issues.

Recommended minimal fix in this PR:

1. Replace fmt.Println/fmt.Printf with Cobra stderr helpers (for example cmd.PrintErrln / cmd.PrintErrf).
2. Check and handle errors from GenBashCompletion and GenZshCompletion (print error + exit non-zero).
3. Drop the fmt import if no longer needed.

Tests run by me: log analysis only (no local rerun of CI jobs).

---

What is this? | From workflow: PR Actions Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

CI failure is caused by generated docs drift in the check-docs workflow, not by the Go/CLI text edits.

mage check fails at check-no-changes with this diff in job check (https://github.com/elastic/beats/actions/runs/22827629967/job/66210446580):

• docs/reference/metricbeat/exported-fields-system.md
• expected during generation: The total number of of milliseconds spent doing I/Os.
• committed in PR: The total number of milliseconds spent doing I/Os.
• error: docs/reference/metricbeat/exported-fields-system.md: needs update

Root cause: the PR changed a generated file directly, but the source string still contains the typo in metricbeat/module/system/diskio/_meta/fields.yml (and matching testdata).

Recommended fix (minimal):

1. Update the source field description in metricbeat/module/system/diskio/_meta/fields.yml from of of -> of.
2. Regenerate docs/fields artifacts (mage update or the targeted metricbeat/docs generation used by Beats maintainers).
3. Commit regenerated outputs (including docs/reference/metricbeat/exported-fields-system.md, and any other generated files touched).

Tests run by me: none locally; analysis based on failed workflow logs for run 22827629967 and job 66210446580.

---

What is this? | From workflow: PR Actions Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[strawgate]

/ai address PR feedback and check for all user facing duplicate word typos in the codebase and resolve any incorrect usage you find