pulse_connect_secure: add mapping for event.create

packages/pulse_connect_secure/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.0.1"
+  changes:
+    - description: Add mapping for `event.create`
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/3544
 - version: "1.0.0"
   changes:
     - description: Make GA

packages/pulse_connect_secure/data_stream/log/fields/ecs.yml

@@ -2,6 +2,8 @@
   name: '@timestamp'
 - external: ecs
   name: ecs.version
+- external: ecs
+  name: event.created
 - external: ecs
   name: event.outcome
 - external: ecs

packages/pulse_connect_secure/docs/README.md

@@ -168,6 +168,7 @@ An example event for `log` looks as following:
 | data_stream.namespace | Data stream namespace. | constant_keyword |
 | data_stream.type | Data stream type. | constant_keyword |
 | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword |
+| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date |
 | event.dataset | Event dataset | constant_keyword |
 | event.module | Event module | constant_keyword |
 | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword |

packages/pulse_connect_secure/manifest.yml

@@ -1,6 +1,6 @@
 name: pulse_connect_secure
 title: Pulse Connect Secure
-version: 1.0.0
+version: 1.0.1
 release: ga
 description: Collect logs from Pulse Connect Secure with Elastic Agent.
 type: integration