# AWS Integrations Mapping Error

**URL:** <https://discuss.elastic.co/t/aws-integrations-mapping-error/283502>\
**Category:** Beats\
**Tags:** fleet\
**Created:** [September 7, 2021, 7:37am UTC](https://discuss.elastic.co/t/aws-integrations-mapping-error/283502 "2021-09-07T07:37:12Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![PhilA](https://avatars.discourse-cdn.com/v4/letter/p/c6cbf5/32.png) [@PhilA](https://discuss.elastic.co/u/PhilA)\
**Post date:** [September 7, 2021, 7:37am UTC](https://discuss.elastic.co/t/aws-integrations-mapping-error/283502/1 "2021-09-07T07:37:12Z")

</div>

Hi

I'm hoping this is posted in the correct place. I believe the AWS mappings in the Fleet Integration are missing a mapping for event.created. I am ingesting Cloudtrail logs via Fleet and I'm getting errors stating the field has been stored as a Keyword.

If I check the Mappings in the Index Template I can't see a mapping for the event.created field, where if I check Azure (which I also have working), it does define event.created as a data.

As both Azure and AWS go in to the logs-\* index pattern it causes a conflict.

As shown below, the aws.cloudtrail dataset on Elastic 7.14.1 (current as of typing) has an error for event.created.

![image](https://us1.discourse-cdn.com/elastic/original/3X/8/5/85b1ab94de6ea3d1874f59d2891faf93b38b25c8.png)

No event.created field mapping

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/0/00b95c53dec89b880186e372f101a010d0586a5a.png)

Thanks

Phil

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [September 7, 2021, 8:12am UTC](https://discuss.elastic.co/t/aws-integrations-mapping-error/283502/2 "2021-09-07T08:12:00Z")

</div>

The field seems indeed to be missing: [https://github.com/elastic/integrations/tree/master/packages/aws/data\_stream/cloudtrail/fields](https://github.com/elastic/integrations/tree/master/packages/aws/data_stream/cloudtrail/fields) Could you open a bug issue here about this: [https://github.com/elastic/integrations](https://github.com/elastic/integrations)

@Kaiyan_Sheng FYI

---

<div class="post-metadata">

**Author:** ![PhilA](https://avatars.discourse-cdn.com/v4/letter/p/c6cbf5/32.png) [@PhilA](https://discuss.elastic.co/u/PhilA)\
**Post date:** [September 7, 2021, 9:22am UTC](https://discuss.elastic.co/t/aws-integrations-mapping-error/283502/3 "2021-09-07T09:22:23Z")

</div>

Thank you for the response, I have raised an issue - hopefully all ok

> <https://github.com/elastic/integrations/issues/1584>
>
> I am ingesting Cloudtrail logs via Fleet and I'm getting errors stating the fiel…d has been stored as a Keyword.
> 
> If I check the Mappings in the Index Template I can't see a mapping for the event.created field, where if I check Azure (which I also have working), it does define event.created as a data.
> 
> As both Azure and AWS go in to the logs-\* index pattern it causes a conflict.
> 
> This has been checked by an Elastic team member and confirmed that the field is missing at The field seems indeed to be missing: \[https://github.com/elastic/integrations/tree/master/packages/aws/data\_stream/cloudtrail/fields\](url)
> 
> Issue initially raised on Elastic discuss forums:
> \[https://discuss.elastic.co/t/aws-integrations-mapping-error/283502\](url) 
> 
> Thanks

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [September 7, 2021, 11:31am UTC](https://discuss.elastic.co/t/aws-integrations-mapping-error/283502/4 "2021-09-07T11:31:48Z")

</div>

Thanks, just added the labels for triaging.

---

<div class="post-metadata">

**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\
**Post date:** [September 7, 2021, 5:17pm UTC](https://discuss.elastic.co/t/aws-integrations-mapping-error/283502/5 "2021-09-07T17:17:08Z")

</div>

Thank you for reporting this! I will work on fixing this asap. Thank you!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 5, 2021, 7:17pm UTC](https://discuss.elastic.co/t/aws-integrations-mapping-error/283502/6 "2021-10-05T19:17:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.