-
Notifications
You must be signed in to change notification settings - Fork 474
Closed
Labels
Integration:elasticsearchElasticsearchElasticsearchIntegration:kibanaKibanaKibanaIntegration:logstashLogstashLogstashTeam:Infra Monitoring UI - DEPRECATEDLabel for the Infrastructure Monitoring UI team. - DEPRECATED - Use Team:obs-ux-infra_servicesLabel for the Infrastructure Monitoring UI team. - DEPRECATED - Use Team:obs-ux-infra_servicesbugSomething isn't working, use only for issuesSomething isn't working, use only for issues
Description
Some SM integration packages data-streams are missing the mapping for the event.created
field, which causes them to be mapped as keyword
and not date
.
Here are a few examples of data streams that are missing this mapping:
- Elasticsearch
- gc
- server
- deprecation
- slowlog
- Kibana
- log
- audit
- Logstash
- log
It might be interesting to make sure the SM packages contain all necessary event
fields mapped
- external: ecs
name: event.ingested
- external: ecs
name: event.kind
- external: ecs
name: event.category
- external: ecs
name: event.type
- external: ecs
name: event.created
- external: ecs
name: event.original
- external: ecs
Acceptance criteria
event.date
is mapped asdate
Metadata
Metadata
Assignees
Labels
Integration:elasticsearchElasticsearchElasticsearchIntegration:kibanaKibanaKibanaIntegration:logstashLogstashLogstashTeam:Infra Monitoring UI - DEPRECATEDLabel for the Infrastructure Monitoring UI team. - DEPRECATED - Use Team:obs-ux-infra_servicesLabel for the Infrastructure Monitoring UI team. - DEPRECATED - Use Team:obs-ux-infra_servicesbugSomething isn't working, use only for issuesSomething isn't working, use only for issues