diff --git a/tools/config/ecs-okta.yml b/tools/config/ecs-okta.yml
index c08d7015c..a4ac6009c 100644
--- a/tools/config/ecs-okta.yml
+++ b/tools/config/ecs-okta.yml
@@ -28,42 +28,7 @@ fieldmappings:
   event.action: okta.event_type
   outcome.reason: okta.outcome.reason
   event.outcome: okta.event.outcome
-  : okta.transaction.id
-  : okta.transaction.type
-  : okta.debug_context.debug_data.device_fingerprint
-  : okta.debug_context.debug_data.request_id
-  : okta.debug_context.debug_data.request_uri
-  : okta.debug_context.debug_data.threat_suspected
-  : okta.debug_context.debug_data.url
-  : okta.debug_context.debug_data.suspicious_activity.browser
-  : okta.debug_context.debug_data.suspicious_activity.event_city
-  : okta.debug_context.debug_data.suspicious_activity.event_country
-  : okta.debug_context.debug_data.suspicious_activity.event_id
-  : okta.debug_context.debug_data.suspicious_activity.event_ip
-  : okta.debug_context.debug_data.suspicious_activity.event_latitude
-  : okta.debug_context.debug_data.suspicious_activity.event_longitude
-  : okta.debug_context.debug_data.suspicious_activity.event_state
-  : okta.debug_context.debug_data.suspicious_activity.event_transaction_id
-  : okta.debug_context.debug_data.suspicious_activity.event_type
-  : okta.debug_context.debug_data.suspicious_activity.os
-  : okta.debug_context.debug_data.suspicious_activity.timestamp
-  : okta.authentication_context.authentication_provider
-  : okta.authentication_context.authentication_step
-  : okta.authentication_context.credential_provider
-  : okta.authentication_context.credential_type
-  : okta.authentication_context.issuer
-  : okta.authentication_context.external_session_id
-  : okta.authentication_context.interface
   client.as.number: okta.security_context.as.number
   client.as.organization.name: okta.security_context.as.organization.name
   client.domain: okta.security_context.isp
   source.domain: okta.security_context.domain
-  : okta.security_context.is_proxy
-  : okta.request.ip_chain.ip
-  : okta.request.ip_chain.version
-  : okta.request.ip_chain.source
-  : okta.request.ip_chain.geographical_context.city
-  : okta.request.ip_chain.geographical_context.state
-  : okta.request.ip_chain.geographical_context.postal_code
-  : okta.request.ip_chain.geographical_context.country
-  : okta.request.ip_chain.geographical_context.geolocation