diff --git a/x-pack/filebeat/input/netflow/convert.go b/x-pack/filebeat/input/netflow/convert.go
index eff8cb5f023..69d7a2ea6cd 100644
--- a/x-pack/filebeat/input/netflow/convert.go
+++ b/x-pack/filebeat/input/netflow/convert.go
@@ -320,9 +320,7 @@ func flowToBeatEvent(flow record.Record) (event beat.Event) {
 		event.Fields["network"] = ecsNetwork
 	}
 	if len(relatedIP) > 0 {
-		ecsRelated := common.MapStr{}
-		ecsRelated["ip"] = relatedIP
-		event.Fields["related"] = ecsRelated
+		event.Fields["related"] = common.MapStr{"ip": relatedIP}
 	}
 	return
 }