From 7727ed259257b5a6ac6d4db548b4a85a8d2aac31 Mon Sep 17 00:00:00 2001 From: Dan Kortschak Date: Tue, 21 Jun 2022 10:19:18 +0930 Subject: [PATCH] pulse_connect_secure: add mapping for `event.create` --- packages/pulse_connect_secure/changelog.yml | 5 +++++ packages/pulse_connect_secure/data_stream/log/fields/ecs.yml | 2 ++ packages/pulse_connect_secure/docs/README.md | 1 + packages/pulse_connect_secure/manifest.yml | 2 +- 4 files changed, 9 insertions(+), 1 deletion(-) diff --git a/packages/pulse_connect_secure/changelog.yml b/packages/pulse_connect_secure/changelog.yml index 08294e1f18d..dbb2255406d 100644 --- a/packages/pulse_connect_secure/changelog.yml +++ b/packages/pulse_connect_secure/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.0.1" + changes: + - description: Add mapping for `event.create` + type: bugfix + link: https://github.com/elastic/integrations/pull/3544 - version: "1.0.0" changes: - description: Make GA diff --git a/packages/pulse_connect_secure/data_stream/log/fields/ecs.yml b/packages/pulse_connect_secure/data_stream/log/fields/ecs.yml index cd455914c85..77a391e09e7 100644 --- a/packages/pulse_connect_secure/data_stream/log/fields/ecs.yml +++ b/packages/pulse_connect_secure/data_stream/log/fields/ecs.yml @@ -2,6 +2,8 @@ name: '@timestamp' - external: ecs name: ecs.version +- external: ecs + name: event.created - external: ecs name: event.outcome - external: ecs diff --git a/packages/pulse_connect_secure/docs/README.md b/packages/pulse_connect_secure/docs/README.md index be731bdde2c..5949b8dd001 100644 --- a/packages/pulse_connect_secure/docs/README.md +++ b/packages/pulse_connect_secure/docs/README.md @@ -168,6 +168,7 @@ An example event for `log` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | diff --git a/packages/pulse_connect_secure/manifest.yml b/packages/pulse_connect_secure/manifest.yml index 221ee6509d6..a1d00eb1c07 100644 --- a/packages/pulse_connect_secure/manifest.yml +++ b/packages/pulse_connect_secure/manifest.yml @@ -1,6 +1,6 @@ name: pulse_connect_secure title: Pulse Connect Secure -version: 1.0.0 +version: 1.0.1 release: ga description: Collect logs from Pulse Connect Secure with Elastic Agent. type: integration