vsphere: populate ECS source.ip and related.ip from client.ip in log ingest pipelines

[Copilot]

vCenter login/logout/failed login/SSH/upload events extract the initiating IP into client.ip but never propagate it to the ECS correlation fields source.ip and related.ip, breaking cross-dataset IP correlation and ECS compliance.

Issue: #18537

Changes

• ingest_pipeline/login.yml and ingest_pipeline/file.yml: append two processors at the end of each pipeline:

- set:
    field: source.ip
    copy_from: client.ip
    if: ctx.client?.ip != null
- append:
    field: related.ip
    value: "{{client.ip}}"
    allow_duplicates: false
    if: ctx.client?.ip != null

• test-format-common.log-expected.json: updated all 24 test cases that assert client.ip to also assert source.ip and related.ip.
• manifest.yml / changelog.yml: bumped package version 1.23.1 → 1.24.0.

[ishleenk17]

/test

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[ishleenk17]

@claude review the PR

[github-actions]

I found one fix needed before merge: the new 1.24.0 changelog entry links to the wrong PR (#16753 instead of #18536). I left an inline suggestion on that line.

Warning

⚠️ Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• mustache.github.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "mustache.github.io"

See Network Configuration for more information.

---

What is this? | From workflow: Mention in PR

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[ishleenk17]

/test

[ishleenk17]

/test

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 3b297d2

History

• 💚 Build #41871 succeeded 652c760
• 💚 Build #41867 succeeded afdb44b

cc @ishleenk17 @Copilot

[elastic-vault-github-plugin-prod]

Package vsphere - 1.24.0 containing this change is available at https://epr.elastic.co/package/vsphere/1.24.0/