[Auditbeat] Change event.kind=error to event.kind=event to comply wit…

…h ECS (elastic#20685) * Change event.kind=error to event.kind=event to coply with ECS * Add CHANGELOG entry
melchiormoulin · Oct 14, 2020 · e437b4e · e437b4e
1 parent caf3f54
commit e437b4e
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -23,6 +23,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 *Auditbeat*
 
 - File integrity dataset (macOS): Replace unnecessary `file.origin.raw` (type keyword) with `file.origin.text` (type `text`). {issue}12423[12423] {pull}15630[15630]
+- Change event.kind=error to event.kind=event to comply with ECS. {issue}18870[18870] {pull}20685[20685]
 
 *Filebeat*
 

diff --git a/x-pack/auditbeat/module/system/process/process.go b/x-pack/auditbeat/module/system/process/process.go
@@ -39,7 +39,6 @@ const (
 
 	eventTypeState = "state"
 	eventTypeEvent = "event"
-	eventTypeError = "error"
 )
 
 type eventAction uint8
@@ -247,7 +246,7 @@ func (ms *MetricSet) reportState(report mb.ReporterV2) error {
 			report.Event(event)
 		} else {
 			ms.log.Warn(p.Error)
-			report.Event(ms.processEvent(p, eventTypeError, eventActionProcessError))
+			report.Event(ms.processEvent(p, eventTypeEvent, eventActionProcessError))
 		}
 	}
 
@@ -287,7 +286,7 @@ func (ms *MetricSet) reportChanges(report mb.ReporterV2) error {
 			report.Event(ms.processEvent(p, eventTypeEvent, eventActionProcessStarted))
 		} else {
 			ms.log.Warn(p.Error)
-			report.Event(ms.processEvent(p, eventTypeError, eventActionProcessError))
+			report.Event(ms.processEvent(p, eventTypeEvent, eventActionProcessError))
 		}
 	}