[Winlog] Can't modify Dataset Name / event.dataset not conforming to ECS

[nicpenning]

• Bug

What does this PR do?

Integration Impacted: Custom Windows Event Logs integration

Screenshot of default Dataset name

Currently, the event.dataset is set to a constant_keyword which prevents anyone from changing the dataset in the custom windows integration. This should be a keyword to conform to ECS and allow anyone to modify the dataset in the integration as it is provided today.

If you change winlog.winlog to anything this will likely error.

Preview of field's value: 'windows.applocker'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"[constant_keyword] field [event.dataset] only accepts values that are equal to the value defined in the mappings [winlog.winlog], but got [windows.applocker]"}}}}}

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Screenshots

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-02-16T00:40:27.362+0000

• Duration: 15 min 24 sec

Test stats 🧪

Test	Results
Failed	0
Passed	2
Skipped	0
Total	2

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

LGTM. The fact that Elastic Agent is always setting event.dataset seems risky (and wasteful of storage) given that almost all integrations use a constant_keyword with static value.

[nicpenning]

Awesome 👌🏻

[andrewkroh]

[2023-02-15T23:26:09.700Z] Error: checking package failed: checking readme files are up-to-date failed: files do not match

CI says the readme needs rebuilt. Can you please run elastic-package build and commit the updated file.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (0/0)	💚
Files	100.0% (0/0)	💚
Classes	100.0% (0/0)	💚
Methods	66.667% (2/3)	❕
Lines	100.0% (0/0)	💚
Conditionals	100.0% (0/0)	💚

[elasticmachine]

Package winlog - 1.12.1 containing this change is available at https://epr.elastic.co/search?package=winlog

[nicpenning]

Thanks for running that for me and reviewing this!