Fix mapper_parsing_exception when parsing event_time

packages/microsoft_sqlserver/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.4.2"
+  changes:
+    - description: Fix mapper_parsing_exception when parsing sqlserver.audit.event_time.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/2813
 - version: "0.4.1"
   changes:
     - description: Change owner to SEI

packages/microsoft_sqlserver/data_stream/audit/_dev/test/pipeline/test-events.json-expected.json

@@ -87,7 +87,6 @@
                     "database_name": "TestDB",
                     "database_principal_id": "1",
                     "database_principal_name": "dbo",
-                    "event_time": "2021-10-23 23:01:20.4050216",
                     "host_name": "WINDEV2108EVAL",
                     "is_column_permission": true,
                     "object_id": "885578193",
@@ -222,7 +221,6 @@
                     "database_name": "Auditable",
                     "database_principal_id": "1",
                     "database_principal_name": "dbo",
-                    "event_time": "2021-10-28 08:44:33.9741294",
                     "host_name": "WINDEV2108EVAL",
                     "is_column_permission": false,
                     "object_id": "581577110",
@@ -356,7 +354,6 @@
                     "client_ip": "local machine",
                     "connection_id": "FADD287E-2D7D-4D1C-9C51-6A9AA7AF461E",
                     "database_principal_id": "0",
-                    "event_time": "2021-10-29 02:09:40.4984112",
                     "host_name": "WINDEV2108EVAL",
                     "is_column_permission": false,
                     "object_id": "0",
@@ -487,7 +484,6 @@
                     "client_ip": "local machine",
                     "connection_id": "5BB7AFC4-A4B5-46CF-B961-55426EAE3968",
                     "database_principal_id": "0",
-                    "event_time": "2021-10-29 04:54:20.5894484",
                     "host_name": "WINDEV2108EVAL",
                     "is_column_permission": false,
                     "object_id": "0",

packages/microsoft_sqlserver/data_stream/audit/elasticsearch/ingest_pipeline/default.yml

@@ -1236,6 +1236,7 @@ processors:
     field:
       - _temp
       - winlog.event_data.param1
+      - sqlserver.audit.event_time
       - sqlserver.audit.additional_information
       - sqlserver.audit.duration_milliseconds 
       - sqlserver.audit.server_principal_name

packages/microsoft_sqlserver/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: microsoft_sqlserver
 title: "Microsoft SQL Server"
-version: 0.4.1
+version: 0.4.2
 license: basic
 description: Collect audit events from Microsoft SQL Server with Elastic Agent.
 type: integration