[System] Type Conflict Error for error.code and error.message fields

[ishleenk17]

In System Integration, the error.code and error.message field mapping is not present explicitly (other than security datastream). Hence, it gets dynamically mapped to long. This throws a type conflict error.

Relates: #4071

[andrewkroh]

It looks like any data stream that has a winlog input should have error.code mapped as per ECS.

https://github.com/elastic/beats/blob/34a87e51a5a30a40f60372acfdae17a14a5faa2c/winlogbeat/eventlog/eventlog.go#L95

The data streams with winlog inputs are:

hid_bravura_monitor/winlog
microsoft_sqlserver/audit
system/application
system/security
system/system
windows/forwarded
windows/powershell
windows/powershell_operational
windows/sysmon_operational
winlog/winlog

And the ones missing error.code are:

• hid_bravura_monitor/winlog [hid_bravura_monitor.winlog] Add ECS error.code mapping #6870
• microsoft_sqlserver/audit [microsoft_sqlserver,system] Add ECS error.code mapping #6868
• system/application [microsoft_sqlserver,system] Add ECS error.code mapping #6868
• system/system [microsoft_sqlserver,system] Add ECS error.code mapping #6868
• windows/forwarded [windows] Add ECS error.code mapping #6869
• windows/powershell [windows] Add ECS error.code mapping #6869
• windows/powershell_operational [windows] Add ECS error.code mapping #6869

[ishleenk17]

Thats right, this should be present in all the winlog input datastreams.

[elasticmachine]

Package windows - 1.24.1 containing this change is available at https://epr.elastic.co/search?package=windows

[elasticmachine]

Package hid_bravura_monitor - 1.8.1 containing this change is available at https://epr.elastic.co/search?package=hid_bravura_monitor