AWS Integrations Mapping Error

[PhilA (Phil)]

Hi

I'm hoping this is posted in the correct place. I believe the AWS mappings in the Fleet Integration are missing a mapping for event.created. I am ingesting Cloudtrail logs via Fleet and I'm getting errors stating the field has been stored as a Keyword.

If I check the Mappings in the Index Template I can't see a mapping for the event.created field, where if I check Azure (which I also have working), it does define event.created as a data.

As both Azure and AWS go in to the logs-* index pattern it causes a conflict.

As shown below, the aws.cloudtrail dataset on Elastic 7.14.1 (current as of typing) has an error for event.created.

No event.created field mapping

Thanks

Phil

[ruflin]

The field seems indeed to be missing: https://github.com/elastic/integrations/tree/master/packages/aws/data_stream/cloudtrail/fields Could you open a bug issue here about this: https://github.com/elastic/integrations

@Kaiyan_Sheng FYI

[PhilA (Phil)]

Thank you for the response, I have raised an issue - hopefully all ok

AWS Integrations Mapping Error

[ruflin]

Thanks, just added the labels for triaging.

[Kaiyan_Sheng]

Thank you for reporting this! I will work on fixing this asap. Thank you!!