diff --git a/.buildkite/scripts/common_windows.ps1 b/.buildkite/scripts/common_windows.ps1
new file mode 100644
index 0000000000..db802a8c5b
--- /dev/null
+++ b/.buildkite/scripts/common_windows.ps1
@@ -0,0 +1,41 @@
+# Forcing to checkout again all the files with a correct autocrlf.
+# Doing this here because we cannot set git clone options before.
+function fixCRLF {
+    Write-Host "-- Fixing CRLF in git checkout --"
+    git config core.autocrlf input
+    git rm --quiet --cached -r .
+    git reset --quiet --hard
+}
+
+function ensureBinPath {
+    $workDir = if ($env:WORKSPACE) { $env:WORKSPACE } else { $PWD.Path }
+    $binDir = Join-Path $workDir "bin"
+    if (-not (Test-Path $binDir)) { New-Item -ItemType Directory -Path $binDir | Out-Null }
+    $env:PATH = "$binDir;$env:PATH"
+    return $binDir
+}
+
+function withGolang($version) {
+    Write-Host "--- Install golang (GVM)"
+    $binDir = ensureBinPath
+    $gvmExe = Join-Path $binDir "gvm-windows-amd64.exe"
+    $gvmUrl = "https://github.com/andrewkroh/gvm/releases/download/$env:SETUP_GVM_VERSION/gvm-windows-amd64.exe"
+
+    Write-Host "Installing GVM tool"
+    $maxTries = 5
+    for ($i = 1; $i -le $maxTries; $i++) {
+        try {
+            Invoke-WebRequest -Uri $gvmUrl -OutFile $gvmExe -UseBasicParsing
+            break
+        } catch {
+            if ($i -eq $maxTries) { throw }
+            Start-Sleep -Seconds 3
+        }
+    }
+
+    Write-Host "Installing Go version $version"
+    & $gvmExe --format=powershell $version | Invoke-Expression
+    $env:PATH = "$(go env GOPATH)\bin;$env:PATH"
+    go version
+    go env
+}
diff --git a/.buildkite/scripts/stack_tests_windows.ps1 b/.buildkite/scripts/stack_tests_windows.ps1
index 58e47b04fa..fc51ff61aa 100644
--- a/.buildkite/scripts/stack_tests_windows.ps1
+++ b/.buildkite/scripts/stack_tests_windows.ps1
@@ -1,24 +1,6 @@
 $ErrorActionPreference = "Stop" # set -e
 
-# Forcing to checkout again all the files with a correct autocrlf.
-# Doing this here because we cannot set git clone options before.
-function fixCRLF {
-    Write-Host "-- Fixing CRLF in git checkout --"
-    git config core.autocrlf input
-    git rm --quiet --cached -r .
-    git reset --quiet --hard
-}
-
-function withGolang($version) {
-    # Avoid conflicts with previous installations.
-    Remove-Item env:GOROOT
-
-    Write-Host "-- Install golang $version --"
-    choco install -y golang --version $version
-    setupChocolateyPath
-    go version
-    go env
-}
+. "$PSScriptRoot\common_windows.ps1"
 
 function withDocker($version) {
     Write-Host "-- Install Docker $version --"
@@ -43,9 +25,12 @@ function setupChocolateyPath() {
 
 fixCRLF
 
-withGolang $env:GO_VERSION
+# Chocolatey's refreshenv (called by withDocker/withDockerCompose) reloads PATH from the
+# registry, which wipes session-only changes made by GVM. Install Go after Chocolatey
+# packages so GVM's PATH entries are not lost.
 withDocker $env:DOCKER_VERSION
 withDockerCompose $env:DOCKER_COMPOSE_VERSION.Substring(1)
+withGolang $env:GO_VERSION
 
 Write-Host "--- Docker Info"
 docker info
diff --git a/.buildkite/scripts/unit_tests_windows.ps1 b/.buildkite/scripts/unit_tests_windows.ps1
index 87747f769a..72ad66d8fc 100644
--- a/.buildkite/scripts/unit_tests_windows.ps1
+++ b/.buildkite/scripts/unit_tests_windows.ps1
@@ -1,26 +1,6 @@
 $ErrorActionPreference = "Stop" # set -e
 
-# Forcing to checkout again all the files with a correct autocrlf.
-# Doing this here because we cannot set git clone options before.
-function fixCRLF {
-    Write-Host "-- Fixing CRLF in git checkout --"
-    git config core.autocrlf input
-    git rm --quiet --cached -r .
-    git reset --quiet --hard
-}
-
-function withGolang($version) {
-    # Avoid conflicts with previous installations.
-    Remove-Item env:GOROOT
-
-    Write-Host "-- Install golang $version --"
-    choco install -y golang --version $version
-    $env:ChocolateyInstall = Convert-Path "$((Get-Command choco).Path)\..\.."
-    Import-Module "$env:ChocolateyInstall\helpers\chocolateyProfile.psm1"
-    refreshenv
-    go version
-    go env
-}
+. "$PSScriptRoot\common_windows.ps1"
 
 function installGoDependencies {
     $installPackages = @(
diff --git a/test/packages/parallel/system/data_stream/process/fields/ecs.yml b/test/packages/parallel/system/data_stream/process/fields/ecs.yml
index 627a7b9547..b569520ac2 100644
--- a/test/packages/parallel/system/data_stream/process/fields/ecs.yml
+++ b/test/packages/parallel/system/data_stream/process/fields/ecs.yml
@@ -49,3 +49,5 @@
 - external: ecs
   name: agent.id
   dimension: true
+- name: error.message
+  external: ecs
diff --git a/test/packages/parallel/system/docs/README.md b/test/packages/parallel/system/docs/README.md
index 64809e15ae..86f2ef9ac4 100644
--- a/test/packages/parallel/system/docs/README.md
+++ b/test/packages/parallel/system/docs/README.md
@@ -1218,6 +1218,7 @@ If running as less privileged user, it may not be able to read process data belo
 | data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions:   \* Must not contain `-`   \* No longer than 100 characters | constant_keyword |  |  |
 | data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword |  |  |
 | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword |  |  |
+| error.message | Error message. | match_only_text |  |  |
 | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword |  |  |
 | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | constant_keyword |  |  |
 | host.architecture | Operating system architecture. | keyword |  |  |