AWS Integrations Mapping Error

Hi

I'm hoping this is posted in the correct place. I believe the AWS mappings in the Fleet Integration are missing a mapping for event.created. I am ingesting Cloudtrail logs via Fleet and I'm getting errors stating the field has been stored as a Keyword.

If I check the Mappings in the Index Template I can't see a mapping for the event.created field, where if I check Azure (which I also have working), it does define event.created as a data.

As both Azure and AWS go in to the logs-* index pattern it causes a conflict.

As shown below, the aws.cloudtrail dataset on Elastic 7.14.1 (current as of typing) has an error for event.created.

image

No event.created field mapping

Thanks

Phil

The field seems indeed to be missing: https://github.com/elastic/integrations/tree/master/packages/aws/data_stream/cloudtrail/fields Could you open a bug issue here about this: https://github.com/elastic/integrations

@Kaiyan_Sheng FYI

Thank you for the response, I have raised an issue - hopefully all ok

1 Like

Thanks, just added the labels for triaging.

Thank you for reporting this! I will work on fixing this asap. Thank you!!

1 Like