# Fleet AWS Integration Error - CloudTrail logs not searchable

**URL:** <https://discuss.elastic.co/t/fleet-aws-integration-error-cloudtrail-logs-not-searchable/258987>\
**Category:** Elasticsearch\
**Tags:** fleet\
**Created:** [December 17, 2020, 12:28pm UTC](https://discuss.elastic.co/t/fleet-aws-integration-error-cloudtrail-logs-not-searchable/258987 "2020-12-17T12:28:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![matt\_t1](https://avatars.discourse-cdn.com/v4/letter/m/dfb087/32.png) [@matt\_t1](https://discuss.elastic.co/u/matt_t1)\
**Post date:** [December 17, 2020, 12:28pm UTC](https://discuss.elastic.co/t/fleet-aws-integration-error-cloudtrail-logs-not-searchable/258987/1 "2020-12-17T12:28:28Z")

</div>

AWS integration version 0.3.12 uses an ingestion node pipeline to set the `event.ingested` field to the ingestion timestamp. There is no mapping for this field in the index template so it defaults to keyword type, which breaks searching on the affected shards. No events are returned using a filter of `data_stream.dataset:aws.cloudtrail`.

Adding an explicit mapping for `event.ingested` to Date type in the index template fixes the issue.

---

<div class="post-metadata">

**Author:** ![skh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skh/32/38637_2.png) [@skh](https://discuss.elastic.co/u/skh)\
**Post date:** [December 18, 2020, 12:06pm UTC](https://discuss.elastic.co/t/fleet-aws-integration-error-cloudtrail-logs-not-searchable/258987/2 "2020-12-18T12:06:43Z")

</div>

Good catch, this looks odd. I'm getting help from someone who knows more about this integration.

---

<div class="post-metadata">

**Author:** ![skh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skh/32/38637_2.png) [@skh](https://discuss.elastic.co/u/skh)\
**Post date:** [December 18, 2020, 2:41pm UTC](https://discuss.elastic.co/t/fleet-aws-integration-error-cloudtrail-logs-not-searchable/258987/3 "2020-12-18T14:41:39Z")

</div>

This is being tracked in [https://github.com/elastic/integrations/issues/473](https://github.com/elastic/integrations/issues/473) now.

Thanks for spotting it!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 15, 2021, 2:41pm UTC](https://discuss.elastic.co/t/fleet-aws-integration-error-cloudtrail-logs-not-searchable/258987/4 "2021-01-15T14:41:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.