AWS Integrations Mapping Error

Elastic Stack Beats
1

Hi

I'm hoping this is posted in the correct place. I believe the AWS mappings in the Fleet Integration are missing a mapping for event.created. I am ingesting Cloudtrail logs via Fleet and I'm getting errors stating the field has been stored as a Keyword.

If I check the Mappings in the Index Template I can't see a mapping for the event.created field, where if I check Azure (which I also have working), it does define event.created as a data.

As both Azure and AWS go in to the logs-* index pattern it causes a conflict.

As shown below, the aws.cloudtrail dataset on Elastic 7.14.1 (current as of typing) has an error for event.created.

image

No event.created field mapping

image
image1436×959 130 KB

Thanks

Phil

2

The field seems indeed to be missing: https://github.com/elastic/integrations/tree/master/packages/aws/data_stream/cloudtrail/fields Could you open a bug issue here about this: https://github.com/elastic/integrations

@Kaiyan_Sheng FYI

3

Thank you for the response, I have raised an issue - hopefully all ok

1 Like
4

Thanks, just added the labels for triaging.

5

Thank you for reporting this! I will work on fixing this asap. Thank you!!

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.