Fleet AWS Integration Error - CloudTrail logs not searchable

Elastic Stack Elasticsearch
1

AWS integration version 0.3.12 uses an ingestion node pipeline to set the event.ingested field to the ingestion timestamp. There is no mapping for this field in the index template so it defaults to keyword type, which breaks searching on the affected shards. No events are returned using a filter of data_stream.dataset:aws.cloudtrail.

Adding an explicit mapping for event.ingested to Date type in the index template fixes the issue.

2

Good catch, this looks odd. I'm getting help from someone who knows more about this integration.

3

This is being tracked in https://github.com/elastic/integrations/issues/473 now.

Thanks for spotting it!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.