[7.17](backport #38709) x-pack/filebeat/module/o365: fix handling of o365.audit.OperationProperties

[mergify]

Proposed commit message

In some cases, this field may be a string. This results in a mapping failure. So in cases where the field is a string, conditionally parse out the JSON.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Closes [o365] Could not index event to Elasticsearch #37800
• Closes [filebeat][o365] Mapping problem on o365.audit.AdditionalInfo #38278

Use cases

Screenshots

Logs

---

This is an automatic backport of pull request #38709 done by [Mergify](https://mergify.com).

[mergify]

Cherry-pick of 8105935 has failed:

On branch mergify/bp/7.17/pr-38709
Your branch is up to date with 'origin/7.17'.

You are currently cherry-picking commit 8105935e24.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   CHANGELOG.next.asciidoc
	modified:   x-pack/filebeat/module/o365/audit/_meta/fields.yml
	modified:   x-pack/filebeat/module/o365/audit/ingest/pipeline.yml
	new file:   x-pack/filebeat/module/o365/audit/test/stringly-json.log
	new file:   x-pack/filebeat/module/o365/audit/test/stringly-json.log-expected.json

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   x-pack/filebeat/module/o365/fields.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[botelastic]

This pull request doesn't have a Team:<team> label.

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2024-04-07T22:58:43.528+0000

• Duration: 65 min 32 sec

Test stats 🧪

Test	Results
Failed	0
Passed	2599
Skipped	155
Total	2754

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)