[Box Events] Update field mapping to account for non-boolean values

[KyleOnK8s]

Proposed commit message

Box Events sends either null or an email to box.source.login when using the admin_logs_streaming setting. Setting this field to a boolean causes data set quality issues and fields to become ignored.

Changing this to a keyword should resolve issues with data set quality.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

How to test this PR locally

Related issues

• Closes [Box Events]: box.source.login is not always boolean #17412

Screenshots

[efd6]

This needs an elastic-package build (or just the application of the following diff):

diff --git a/packages/box_events/docs/README.md b/packages/box_events/docs/README.md
index 1b09c46a4d..f3437d7c42 100644
--- a/packages/box_events/docs/README.md
+++ b/packages/box_events/docs/README.md
@@ -227,7 +227,7 @@ Preserves a raw copy of the original event, added to the field `event.original`.
 | box.source.item_status | Defines if this item has been deleted or not. active when the item has is not in the trash trashed when the item has been moved to the trash but not deleted deleted when the item has been permanently deleted. Value is one of `active`, `trashed`, `deleted` | keyword |
 | box.source.job_title | User job title | boolean |
 | box.source.language | User preferred language | boolean |
-| box.source.login | User login | boolean |
+| box.source.login | User login | keyword |
 | box.source.max_upload_size | Max upload size | boolean |
 | box.source.modified_at | The date and time at which this folder was last updated | date |
 | box.source.modified_by.id | The unique identifier for this user that last modified the file. | keyword |

Can you add a test for this? There is no event in the pipeline tests for this field, which is presumably why it has persisted so long.

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[github-actions]

✅ Vale Linting Results

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[KyleOnK8s]

This needs an elastic-package build (or just the application of the following diff):

Can you add a test for this? There is no event in the pipeline tests for this field, which is presumably why it has persisted so long.

@efd6 Sorry for the delay. This should be done. Can you re-review please?

[efd6]

/test

[efd6]

Please make the change in the fields.yml and then regenerate the documentation with elastic-package build.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

Can you use the text that I suggested? At the moment, it is not grammatically correct.

[KyleOnK8s]

@efd6 done. Sorry, I didn't realize you had changed the grammar. I didn't edit that field in this PR so I was just adding the periods to make the linter happy.

I had to remove the colon in your example. It threw an error because it thought I was trying to define another key. \: didn't work either so I just removed it.

[efd6]

/test

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 85670c0

History

• 💚 Build #40206 succeeded 85670c0
• 💚 Build #40202 succeeded c01bdac
• 💚 Build #40126 succeeded dc1d214
• 💔 Build #40125 failed 83e1e5f
• 💔 Build #40119 failed d5f2794
• 💔 Build #40117 failed aac14cf

[efd6]

Thanks

[elastic-vault-github-plugin-prod]

Package box_events - 3.1.2 containing this change is available at https://epr.elastic.co/package/box_events/3.1.2/