Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[System] Type Conflict Error for error.code and error.message fields #6766

Closed
ishleenk17 opened this issue Jun 30, 2023 · 4 comments · Fixed by #6868
Closed

[System] Type Conflict Error for error.code and error.message fields #6766

ishleenk17 opened this issue Jun 30, 2023 · 4 comments · Fixed by #6868
Assignees
@ishleenk17
Labels
Integration:hid_bravura_monitor Bravura Monitor Integration:microsoft_sqlserver Microsoft SQL Server Integration:system System Integration:windows Windows release-pending

Comments

@ishleenk17
Copy link
Contributor

ishleenk17 commented Jun 30, 2023 •
edited by andrewkroh
Loading

In System Integration, the error.code and error.message field mapping is not present explicitly (other than security datastream). Hence, it gets dynamically mapped to long. This throws a type conflict error.

Screenshot 2023-06-30 at 2 21 11 PM

Relates: #4071
@ishleenk17 ishleenk17 self-assigned this Jun 30, 2023
@andrewkroh
Copy link
Member

andrewkroh commented Jun 30, 2023 •
edited
Loading

It looks like any data stream that has a winlog input should have error.code mapped as per ECS.

https://github.com/elastic/beats/blob/34a87e51a5a30a40f60372acfdae17a14a5faa2c/winlogbeat/eventlog/eventlog.go#L95

The data streams with winlog inputs are:

hid_bravura_monitor/winlog
microsoft_sqlserver/audit
system/application
system/security
system/system
windows/forwarded
windows/powershell
windows/powershell_operational
windows/sysmon_operational
winlog/winlog

And the ones missing error.code are:

@ishleenk17
Copy link
Contributor Author

Thats right, this should be present in all the winlog input datastreams.

@ishleenk17 ishleenk17 mentioned this issue Jul 7, 2023
Merged
4 tasks
andrewkroh added a commit to andrewkroh/integrations that referenced this issue Jul 7, 2023
@andrewkroh
windows - Add ECS error.code mapping
2169d44 
The winlog input can produce error.code under some conditions so
make sure their is a mapping present for the field that is aligned to ECS.

Relates elastic#6766
@andrewkroh andrewkroh mentioned this issue Jul 7, 2023
Merged
4 tasks
andrewkroh added a commit to andrewkroh/integrations that referenced this issue Jul 7, 2023
@andrewkroh
[hid_bravura_monitor.winlog] Add ECS error.code mapping
7771600 
The `winlog` input can produce error.code under some conditions so make sure their is a mapping present for the field that is aligned to ECS.

Relates elastic#6766
@andrewkroh andrewkroh mentioned this issue Jul 7, 2023
Merged
4 tasks
andrewkroh added a commit that referenced this issue Jul 7, 2023
@andrewkroh
windows - Add ECS error.code mapping (#6869)
b310313 
The winlog input can produce error.code under some conditions so
make sure their is a mapping present for the field that is aligned to ECS.

Relates #6766
@elasticmachine
Copy link

Package windows - 1.24.1 containing this change is available at https://epr.elastic.co/search?package=windows

andrewkroh added a commit that referenced this issue Jul 7, 2023
@andrewkroh
[hid_bravura_monitor.winlog] Add ECS error.code mapping (#6870)
f855d53 
The `winlog` input can produce error.code under some conditions so make sure their is a mapping present for the field that is aligned to ECS.

Relates #6766
@elasticmachine
Copy link

Package hid_bravura_monitor - 1.8.1 containing this change is available at https://epr.elastic.co/search?package=hid_bravura_monitor

@ishleenk17 ishleenk17 mentioned this issue Aug 14, 2023
Closed
@ishleenk17 ishleenk17 mentioned this issue Jan 30, 2024
Merged
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ishleenk17 ishleenk17

Labels
Integration:hid_bravura_monitor Bravura Monitor Integration:microsoft_sqlserver Microsoft SQL Server Integration:system System Integration:windows Windows release-pending
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[microsoft_sqlserver,system] Add ECS error.code mapping ishleenk17/ish_integrations
3 participants
@andrewkroh @elasticmachine @ishleenk17