Azure Platform Logs: rename identity as identity_name when the value is a string

packages/azure/changelog.yml

@@ -1,3 +1,8 @@
+- version: "1.5.5"
+  changes:
+    - description: Rename identity as identity_name when the value is a string
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4629
 - version: "1.5.4"
   changes:
     - description: Enable Event Hub integration by default and improve documentation

packages/azure/data_stream/platformlogs/_dev/test/pipeline/test-platformlogs-identity-raw.log

@@ -0,0 +1 @@
+{"Cloud":"AzureCloud","Environment":"prod","category":"kube-audit","ccpNamespace":"5e4bf4baee195b00017cdbfa","operationName":"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read","identity":"Michael Dell","properties":{"log":"{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"Metadata\",\"auditID\":\"22af12c3-a1fe-4f2c-99a9-3cdde671dbfe\"}","pod":"kube-apiserver-666bd4b459-hjgdc","stream":"stdout"},"resourceId":"/SUBSCRIPTIONS/70BD6E77-4B1E-4835-8896-DB77B8EEF364/RESOURCEGROUPS/OBS-INFRASTRUCTURE/PROVIDERS/MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/OBSKUBE","time":"2020-11-09T10:57:31.0000000Z"}

packages/azure/data_stream/platformlogs/_dev/test/pipeline/test-platformlogs-identity-raw.log-expected.json

@@ -0,0 +1,49 @@
+{
+    "expected": [
+        {
+            "@timestamp": "2020-11-09T10:57:31.000Z",
+            "azure": {
+                "platformlogs": {
+                    "Cloud": "AzureCloud",
+                    "Environment": "prod",
+                    "category": "kube-audit",
+                    "ccpNamespace": "5e4bf4baee195b00017cdbfa",
+                    "event_category": "Administrative",
+                    "identity_name": "Michael Dell",
+                    "operation_name": "Microsoft.ContainerService/managedClusters/diagnosticLogs/Read",
+                    "properties": {
+                        "log": {
+                            "apiVersion": "audit.k8s.io/v1",
+                            "auditID": "22af12c3-a1fe-4f2c-99a9-3cdde671dbfe",
+                            "kind": "Event",
+                            "level": "Metadata"
+                        },
+                        "pod": "kube-apiserver-666bd4b459-hjgdc",
+                        "stream": "stdout"
+                    }
+                },
+                "resource": {
+                    "group": "OBS-INFRASTRUCTURE",
+                    "id": "/SUBSCRIPTIONS/70BD6E77-4B1E-4835-8896-DB77B8EEF364/RESOURCEGROUPS/OBS-INFRASTRUCTURE/PROVIDERS/MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/OBSKUBE",
+                    "name": "OBSKUBE",
+                    "provider": "MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS"
+                },
+                "subscription_id": "70BD6E77-4B1E-4835-8896-DB77B8EEF364"
+            },
+            "cloud": {
+                "provider": "azure"
+            },
+            "ecs": {
+                "version": "8.0.0"
+            },
+            "event": {
+                "action": "Microsoft.ContainerService/managedClusters/diagnosticLogs/Read",
+                "kind": "event",
+                "original": "{\"Cloud\":\"AzureCloud\",\"Environment\":\"prod\",\"category\":\"kube-audit\",\"ccpNamespace\":\"5e4bf4baee195b00017cdbfa\",\"operationName\":\"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read\",\"identity\":\"Michael Dell\",\"properties\":{\"log\":\"{\\\"kind\\\":\\\"Event\\\",\\\"apiVersion\\\":\\\"audit.k8s.io/v1\\\",\\\"level\\\":\\\"Metadata\\\",\\\"auditID\\\":\\\"22af12c3-a1fe-4f2c-99a9-3cdde671dbfe\\\"}\",\"pod\":\"kube-apiserver-666bd4b459-hjgdc\",\"stream\":\"stdout\"},\"resourceId\":\"/SUBSCRIPTIONS/70BD6E77-4B1E-4835-8896-DB77B8EEF364/RESOURCEGROUPS/OBS-INFRASTRUCTURE/PROVIDERS/MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/OBSKUBE\",\"time\":\"2020-11-09T10:57:31.0000000Z\"}"
+            },
+            "tags": [
+                "preserve_original_event"
+            ]
+        }
+    ]
+}

packages/azure/data_stream/platformlogs/elasticsearch/ingest_pipeline/default.yml

@@ -54,6 +54,12 @@ processors:
             field: tags
             value: ["preserve_original_event"]
             ignore_failure: true
+  - rename:
+      field: azure.platformlogs.identity
+      if: "ctx.azure?.platformlogs?.identity instanceof String"
+      target_field: azure.platformlogs.identity_name
+      ignore_missing: true
+      description: 'Rename the field to `identity_name` to avoid conflicts with the `identity` containing a JSON object.'
   - date:
       field: azure.platformlogs.time
       target_field: '@timestamp'

packages/azure/data_stream/platformlogs/fields/fields.yml

@@ -66,6 +66,10 @@
       description: >
         ActivityId
 
+    - name: identity_name
+      type: keyword
+      description: |
+        Identity name
     - name: properties
       type: flattened
       description: |-

packages/azure/docs/platformlogs.md

@@ -146,6 +146,7 @@ An example event for `platformlogs` looks as following:
 | azure.platformlogs.category | Category | keyword |
 | azure.platformlogs.ccpNamespace | ccpNamespace | keyword |
 | azure.platformlogs.event_category | Event Category | keyword |
+| azure.platformlogs.identity_name | Identity name | keyword |
 | azure.platformlogs.operation_name | Operation name | keyword |
 | azure.platformlogs.properties | Event properties | flattened |
 | azure.platformlogs.result_description | Result description | keyword |

packages/azure/manifest.yml

@@ -1,6 +1,6 @@
 name: azure
 title: Azure Logs
-version: 1.5.4
+version: 1.5.5
 release: ga
 description: This Elastic integration collects logs from Azure
 type: integration