Background

Firehose integration ¹ utilizes several other AWS data streams added through AWS integration ². Most of those integrations do not currently define event.dataset field (ex: see Cloudtrail fields³).

Problem

Other components rely on the existence of the event.dataset field. For example, consider the pre-build security rule ⁴. These rules will fail to work with current integration configurations as data lacks the required field.

Solution

Update integrations to add event.dataset where possible with correct constant values. For example, Cloudtrail should have event.dataset: aws.cloudtrail. This must get added through relevant AWS assets as Firehose internally perform rerouting ( for example see logs ⁵ and metrics ⁶)