AWS Integrations Mapping Error


I'm hoping this is posted in the correct place. I believe the AWS mappings in the Fleet Integration are missing a mapping for event.created. I am ingesting Cloudtrail logs via Fleet and I'm getting errors stating the field has been stored as a Keyword.

If I check the Mappings in the Index Template I can't see a mapping for the event.created field, where if I check Azure (which I also have working), it does define event.created as a data.

As both Azure and AWS go in to the logs-* index pattern it causes a conflict.

As shown below, the aws.cloudtrail dataset on Elastic 7.14.1 (current as of typing) has an error for event.created.


No event.created field mapping



The field seems indeed to be missing: Could you open a bug issue here about this:

@Kaiyan_Sheng FYI

Thank you for the response, I have raised an issue - hopefully all ok

1 Like

Thanks, just added the labels for triaging.

Thank you for reporting this! I will work on fixing this asap. Thank you!!

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.