[zoom] Add support for the activity data stream by brijesh-elastic · Pull Request #19481 · elastic/integrations

brijesh-elastic · 2026-06-10T10:37:30Z

Proposed commit message

zoom: add support for activity data stream

This data stream collects sign in / sign out activity logs report of users under a Zoom account.
API documentation is available here[1] and test samples were derived from documentation.

This PR also updates the README documentation to follow the latest guidelines.

[1] https://developers.zoom.us/docs/api/meetings/#tag/reports/get/report/activities

Note

To Reviewers:

This data stream has not been tested with a live instance.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/zoom directory.
Run the following command to run tests.

elastic-package test -v

Related issues

Relates [zoom] Add API support for operations logs #15236

Screenshots

github-actions · 2026-06-10T10:38:45Z

Elastic Docs Style Checker (Vale)

Summary: 2 warnings, 1 suggestion found

⚠️ Warnings (2): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/zoom/_dev/build/docs/README.md	5	Elastic.EndPuntuaction	Don't end headings with punctuation.
packages/zoom/manifest.yml	76	Elastic.DontUse	Don't use 'Please'.

💡 Suggestions (1): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/zoom/_dev/build/docs/README.md	47	Elastic.Versions	Use 'or later' instead of 'or higher' when referring to versions.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

elastic-vault-github-plugin-prod · 2026-06-10T11:05:01Z

🚀 Benchmarks report

Package `zoom` 👍(1) 💚(0) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
`webhook`	3105.59	2057.61	-1047.98 (-33.74%)	💔

To see the full report comment with /test benchmark fullreport

…tempts logs in reports api

infra-vault-gh-plugin-prod · 2026-07-01T13:14:20Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

vera-review-bot · 2026-07-01T14:45:56Z

+      value: sign-out
+      if: ctx.zoom?.activity?.type == 'Sign out'
+  - set:
+      field: event.category


Severity: 🟡 Medium confidence: medium path: packages/zoom/data_stream/activity/elasticsearch/ingest_pipeline/default.yml:78

Use append with allow_duplicates: false (not set) for the ECS array fields event.category and event.type, so the pipeline composes with any prior/@custom categorization instead of clobbering it.

Details

event.category and event.type are ECS array fields. The pipeline populates them with set processors that assign the whole list value. The documented convention for new data streams is to build these arrays with append (using allow_duplicates: false), which is idempotent and preserves any values a prior or @custom pipeline may have already added. Functionally the current set produces correct output for the values in scope here, so this is a standards/composability improvement rather than a broken behavior; the same applies to the two event.type processors (set_event_type_start, set_event_type_end).

Recommendation:

Replace the set processors for event.category / event.type with append:

- append: field: event.category tag: append_event_category_auth_session value: - authentication - session allow_duplicates: false if: ctx.zoom?.activity?.type == 'Sign in' || ctx.zoom?.activity?.type == 'Sign out' - append: field: event.type tag: append_event_type_start value: start allow_duplicates: false if: ctx.zoom?.activity?.type == 'Sign in' - append: field: event.type tag: append_event_type_end value: end allow_duplicates: false if: ctx.zoom?.activity?.type == 'Sign out'

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

mergify · 2026-07-02T05:48:58Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

vera-review-bot · 2026-07-02T06:04:27Z

+      if: ctx.source?.ip != null
+
+  # cleanup
+  - remove:


Severity: 🟠 High confidence: high path: packages/zoom/data_stream/activity/elasticsearch/ingest_pipeline/default.yml:174

The pipeline never removes event.original when preserve_original_event is disabled, so the manifest's preserve_original_event toggle (default false) is a no-op and the full raw event is always stored; add a conditional remove of event.original.

Details

The pipeline renames message to event.original (tag rename_message_to_event_original) and never removes it. The data stream manifest declares a preserve_original_event variable defaulting to false, and the CEL template only appends the preserve_original_event tag when that variable is true. Because no processor removes event.original when the tag is absent, event.original is retained on every document regardless of the setting. Result: the documented preserve_original_event: false default has no effect and the full raw JSON of every activity record is stored unconditionally (storage bloat and behavior contradicting the exposed option). The standard Elastic pattern removes event.original unless the preserve_original_event tag is present.

Recommendation:

Add a conditional remove of event.original in the cleanup section (keeping it only when the preserve_original_event tag is set):

- remove: field: event.original tag: remove_original_event if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) ignore_missing: true

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

vera-review-bot · 2026-07-02T06:04:29Z

Review summary

Issues found across the latest commits [7c20fef](https://github.com/elastic/integrations/commit/7c20fefc634ee4f86654b6b327b266a53f542cc6) — 1 high

🟠 The pipeline never removes event.original when preserve_original_event is disabled, so the manifest's preserve_original_event toggle (default false) is a no-op and the full raw event is always stored; add a conditional remove of event.original. (link) (Unresolved)

Issues found across earlier commits [6b66ef7](https://github.com/elastic/integrations/commit/6b66ef738a60e7221d27b456a4512a34ba0ae7ca) — 1 medium

🟡 Use append with allow_duplicates: false (not set) for the ECS array fields event.category and event.type, so the pipeline composes with any prior/@custom categorization instead of clobbering it. (link) (Unresolved)

I'll pick up this PR for review again after 15 minutes.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

elastic-vault-github-plugin-prod · 2026-07-03T07:24:26Z

✅ All changelog entries have the correct PR link.

infra-vault-gh-plugin-prod · 2026-07-03T07:42:41Z

💚 Build Succeeded

Buildkite Build
Commit: e738596

History

💚 Build #45375 succeeded 7c20fef
💚 Build #45326 succeeded 6b66ef7
💚 Build #44378 succeeded 2c02adb

cc @brijesh-elastic

navnit-elastic

LGTM, Thanks!

elastic-vault-github-plugin-prod · 2026-07-06T06:32:50Z

Package zoom - 1.24.0 containing this change is available at https://epr.elastic.co/package/zoom/1.24.0/

Add support for the activity data stream

269057e

brijesh-elastic self-assigned this Jun 10, 2026

brijesh-elastic added 2 commits June 10, 2026 16:12

add dashboard screenshot

963469f

update changelog entry

2c02adb

Add note about zoom does not provide failed sign-in/authentication at…

6b66ef7

…tempts logs in reports api

brijesh-elastic marked this pull request as ready for review July 1, 2026 13:14

brijesh-elastic requested review from a team as code owners July 1, 2026 13:14

infra-vault-gh-plugin-prod Bot deleted a comment from elasticmachine Jul 1, 2026

vera-review-bot Bot reviewed Jul 1, 2026

View reviewed changes

efd6 reviewed Jul 1, 2026

View reviewed changes

Comment thread packages/zoom/data_stream/activity/agent/stream/cel.yml.hbs Outdated

Comment thread packages/zoom/data_stream/activity/agent/stream/cel.yml.hbs Outdated

Comment thread packages/zoom/data_stream/activity/agent/stream/cel.yml.hbs Outdated

address comments

7c20fef

brijesh-elastic requested a review from efd6 July 2, 2026 05:26

efd6 approved these changes Jul 2, 2026

View reviewed changes

vera-review-bot Bot reviewed Jul 2, 2026

View reviewed changes

navnit-elastic reviewed Jul 2, 2026

View reviewed changes

address comments

e738596

navnit-elastic approved these changes Jul 6, 2026

View reviewed changes

brijesh-elastic merged commit a0cd15a into elastic:main Jul 6, 2026
12 checks passed

Uh oh!

Conversation

brijesh-elastic commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

github-actions Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Elastic Docs Style Checker (Vale)

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Package zoom 👍(1) 💚(0) 💔(1)

Uh oh!

infra-vault-gh-plugin-prod Bot commented Jul 1, 2026

Uh oh!

vera-review-bot Bot Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mergify Bot commented Jul 2, 2026

Uh oh!

vera-review-bot Bot Jul 2, 2026

Choose a reason for hiding this comment

Uh oh!

vera-review-bot Bot commented Jul 2, 2026

Review summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 3, 2026

Uh oh!

infra-vault-gh-plugin-prod Bot commented Jul 3, 2026

💚 Build Succeeded

History

Uh oh!

navnit-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

brijesh-elastic commented Jun 10, 2026 •

edited

Loading

github-actions Bot commented Jun 10, 2026 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented Jun 10, 2026 •

edited

Loading

Package `zoom` 👍(1) 💚(0) 💔(1)