elastic · ishleenk17 · Jul 17, 2023 · Jul 7, 2023 · Jul 7, 2023 · Jul 17, 2023
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.1.1"
+  changes:
+    - description: Add ecs mapping for error.code to avoid type conflicts
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/6868
 - version: "2.1.0"
   changes:
     - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html.

@@ -1,5 +1,9 @@
 - external: ecs
   name: message
+- external: ecs
+  name: error.message
+- external: ecs
+  name: error.code
 - external: ecs
   name: destination.user.domain
 - external: ecs

@@ -129,6 +129,8 @@ The SQL Server audit dataset provides events from the configured Windows event l
 | destination.user.name | Short name or login of the user. | keyword |
 | destination.user.name.text | Multi-field of `destination.user.name`. | match_only_text |
 | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword |
+| error.code | Error code describing the error. | keyword |
+| error.message | Error message. | match_only_text |
 | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword |
 | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword |
 | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword |

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: microsoft_sqlserver
 title: "Microsoft SQL Server"
-version: "2.1.0"
+version: "2.1.1"
 license: basic
 description: Collect events from Microsoft SQL Server with Elastic Agent
 type: integration

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.36.2"
+  changes:
+    - description: Add ecs mapping for error.code to avoid type conflicts
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/6868
 - version: "1.36.1"
   changes:
     - description: Fix EventIDs for Users Added to Group panel

@@ -1,5 +1,7 @@
 - external: ecs
   name: error.message
+- external: ecs
+  name: error.code
 - external: ecs
   name: event.code
 - external: ecs

@@ -1,5 +1,7 @@
 - external: ecs
   name: error.message
+- external: ecs
+  name: error.code
 - external: ecs
   name: event.action
 - external: ecs

@@ -114,6 +114,7 @@ The Windows `application` data stream provides events from the Windows
 | data_stream.dataset | Data stream dataset. | constant_keyword |
 | data_stream.namespace | Data stream namespace. | constant_keyword |
 | data_stream.type | Data stream type. | constant_keyword |
+| error.code | Error code describing the error. | keyword |
 | error.message | Error message. | match_only_text |
 | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword |
 | event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date |
@@ -303,6 +304,7 @@ event log.
 | data_stream.dataset | Data stream dataset. | constant_keyword |
 | data_stream.namespace | Data stream namespace. | constant_keyword |
 | data_stream.type | Data stream type. | constant_keyword |
+| error.code | Error code describing the error. | keyword |
 | error.message | Error message. | match_only_text |
 | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword |
 | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword |

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: system
 title: System
-version: 1.36.1
+version: 1.36.2
 license: basic
 description: Collect system logs and metrics from your servers with Elastic Agent.
 type: integration