AWS integration version 0.3.12 uses an ingestion node pipeline to set the
event.ingested field to the ingestion timestamp. There is no mapping for this field in the index template so it defaults to keyword type, which breaks searching on the affected shards. No events are returned using a filter of
Adding an explicit mapping for
event.ingested to Date type in the index template fixes the issue.