[Forescout] Add error.message presence check when removing event.original and update changelog

[akshraj-crest]

Proposed commit message

Add error.message presence check when removing event.original and update changelog for Forescout

[elastic-vault-github-plugin-prod]

Reviewers

Buildkite won't run for external contributors automatically; you need to add a comment:

• /test : will kick off a build in Buildkite.

NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.

[cla-checker-service]

💚 CLA has been signed

[macroscopeapp]

🟢 Low kibana/envoy.yaml:472

The gauge's ESQL query pre-multiplies the ratio by 100 (100 * ...), but the metric format uses type: percent which multiplies by 100 again. This causes the gauge to display "9,500.0%" instead of "95.0%". Either remove the * 100 from the EVAL and update _gauge_max to 1, or change type: percent to number with suffix: " %".

-       - EVAL ratio = 100 * (envoy.http.ingress_http.downstream_rq_2xx / envoy.http.ingress_http.downstream_rq_completed)
+       - EVAL ratio = envoy.http.ingress_http.downstream_rq_2xx / envoy.http.ingress_http.downstream_rq_completed

🤖 Copy this AI Prompt to have your agent fix this:

In file packages/envoyproxy_otel/_dev/shared/kibana/envoy.yaml around lines 472-485:

The gauge's ESQL query pre-multiplies the ratio by 100 (`100 * ...`), but the metric format uses `type: percent` which multiplies by 100 again. This causes the gauge to display "9,500.0%" instead of "95.0%". Either remove the `* 100` from the EVAL and update `_gauge_max` to `1`, or change `type: percent` to `number` with `suffix: " %"`.

[macroscopeapp]

🟢 Low workflows/notify-package-docs-failure.yml:49

The duplicate-comment check queries repos/${REPO}/issues/${PR_NUMBER}/comments without --paginate. The GitHub API returns only 30 comments per page by default, so if the PR has more than 30 comments and the notification comment is beyond the first page, the check incorrectly reports EXISTING=0 and posts a duplicate. Consider adding --paginate to ensure all comments are searched.

Suggested change

	EXISTING=$(gh api "repos/${REPO}/issues/${PR_NUMBER}/comments" \
	--jq '[.[] | select(.body | contains("Package docs validation failed"))] | length')
	EXISTING=$(gh api --paginate "repos/${REPO}/issues/${PR_NUMBER}/comments" \

🤖 Copy this AI Prompt to have your agent fix this:

In file .github/workflows/notify-package-docs-failure.yml around lines 49-50:

The duplicate-comment check queries `repos/${REPO}/issues/${PR_NUMBER}/comments` without `--paginate`. The GitHub API returns only 30 comments per page by default, so if the PR has more than 30 comments and the notification comment is beyond the first page, the check incorrectly reports `EXISTING=0` and posts a duplicate. Consider adding `--paginate` to ensure all comments are searched.

[osullivandonal]

This PR is huge, it looks like this was a bad rebase? Could we clean up the git history? We should probably close this PR and open a new one with a clean git history.

[akshraj-crest]

Closing this PR for now due to rebase issues.