diff --git a/packages/microsoft_sqlserver/changelog.yml b/packages/microsoft_sqlserver/changelog.yml index 5f8be3e4cd6..30b70095a86 100644 --- a/packages/microsoft_sqlserver/changelog.yml +++ b/packages/microsoft_sqlserver/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "0.4.2" + changes: + - description: Fix mapper_parsing_exception when parsing sqlserver.audit.event_time. + type: bugfix + link: https://github.com/elastic/integrations/pull/2813 - version: "0.4.1" changes: - description: Change owner to SEI diff --git a/packages/microsoft_sqlserver/data_stream/audit/_dev/test/pipeline/test-events.json-expected.json b/packages/microsoft_sqlserver/data_stream/audit/_dev/test/pipeline/test-events.json-expected.json index 96fff82eda2..aeb8ed769ad 100644 --- a/packages/microsoft_sqlserver/data_stream/audit/_dev/test/pipeline/test-events.json-expected.json +++ b/packages/microsoft_sqlserver/data_stream/audit/_dev/test/pipeline/test-events.json-expected.json @@ -87,7 +87,6 @@ "database_name": "TestDB", "database_principal_id": "1", "database_principal_name": "dbo", - "event_time": "2021-10-23 23:01:20.4050216", "host_name": "WINDEV2108EVAL", "is_column_permission": true, "object_id": "885578193", @@ -222,7 +221,6 @@ "database_name": "Auditable", "database_principal_id": "1", "database_principal_name": "dbo", - "event_time": "2021-10-28 08:44:33.9741294", "host_name": "WINDEV2108EVAL", "is_column_permission": false, "object_id": "581577110", @@ -356,7 +354,6 @@ "client_ip": "local machine", "connection_id": "FADD287E-2D7D-4D1C-9C51-6A9AA7AF461E", "database_principal_id": "0", - "event_time": "2021-10-29 02:09:40.4984112", "host_name": "WINDEV2108EVAL", "is_column_permission": false, "object_id": "0", @@ -487,7 +484,6 @@ "client_ip": "local machine", "connection_id": "5BB7AFC4-A4B5-46CF-B961-55426EAE3968", "database_principal_id": "0", - "event_time": "2021-10-29 04:54:20.5894484", "host_name": "WINDEV2108EVAL", "is_column_permission": false, "object_id": "0", diff --git a/packages/microsoft_sqlserver/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/microsoft_sqlserver/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index 7d14206b04b..79ef2ef360a 100644 --- a/packages/microsoft_sqlserver/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/microsoft_sqlserver/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -1236,6 +1236,7 @@ processors: field: - _temp - winlog.event_data.param1 + - sqlserver.audit.event_time - sqlserver.audit.additional_information - sqlserver.audit.duration_milliseconds - sqlserver.audit.server_principal_name diff --git a/packages/microsoft_sqlserver/manifest.yml b/packages/microsoft_sqlserver/manifest.yml index 542d9bb9785..eca9e5b76f0 100644 --- a/packages/microsoft_sqlserver/manifest.yml +++ b/packages/microsoft_sqlserver/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: microsoft_sqlserver title: "Microsoft SQL Server" -version: 0.4.1 +version: 0.4.2 license: basic description: Collect audit events from Microsoft SQL Server with Elastic Agent. type: integration