Update ECS in auditbeat sessionmd processor (#38994)

The sessionmd processor requires some of the latest process field from ECS, that are not currently in libbeat. This adds the required ECS field assets to the processor. Without these fields, some field types would be incorrect. For example, `session_leader.start` should be date, but were sent as keyword.
elastic · Apr 18, 2024 · a0dfeea · a0dfeea
1 parent eb122ef
commit a0dfeea
Show file tree

Hide file tree

Showing 3 changed files with 1,376 additions and 1 deletion.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -93,7 +93,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Fix cache processor expiries infinite growth when large a large TTL is used and recurring keys are cached. {pull}38561[38561]
 
 *Auditbeat*
-
+- Set field types to correctly match ECS in sessionmd processor {issue}38955[38955] {pull}38994[38994]
 
 *Filebeat*