tines: make inputs object arrays flattened

[efd6]

What does this PR do?

Makes tines.audit_log.inputs.inputs.{agents,diagramNotes,links} object arrays flattened.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• @SpencerLN Can you confirm any documents with a non-empty tines.audit_log.inputs.inputs.agents array? It would be good to know that it is actually an array of object (this is not documented in the Tines docs)
• Can you confirm that we need to map standardLibVersion as a keyword. It looks like it may well be a number, but I'm being conservative here. Have you seen any non-numeric values? (also apparently not documented).

How to test this PR locally

Related issues

• Fixes Tines Integration Mapping Issues #5497

Screenshots

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-03-09T22:24:32.034+0000

• Duration: 15 min 42 sec

Test stats 🧪

Test	Results
Failed	0
Passed	12
Skipped	0
Total	12

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[SpencerLN]

@efd6, here is a sample document that has the inputs.inputs.agent field:

        {
            "created_at": "2023-03-01T18:10:03Z",
            "operation_name": "StoryItemsCreation",
            "id": 26088,
            "inputs": {
                "inputs": {
                    "storyId": 125,
                    "links": [
                        {
                            "sourceIdentifier": "QW=",
                            "receiverIdentifier": "Q="
                        }
                    ],
                    "agents": [
                        {
                            "name": "Concat",
                            "disabled": false,
                            "position": {
                                "x": -285,
                                "y": 750
                            },
                            "options": "{\"mode\":\"message_only\",\"loop\":false,\"payload\":{\"data\":\"This is an automatically generated message from Tines\"}}",
                            "schedule": null,
                            "type": "eventTransformation",
                            "timeSavedUnit": "minutes",
                            "timeSavedValue": 0,
                            "softDeletedId": 5213
                        }
                    ],
                    "diagramNotes": []
                },
                "liveEvents": null
            },
            "request_ip": "8.8.8.8",
            "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36",
            "tenant_id": 1,
            "updated_at": "2023-03-01T18:10:03Z",
            "user_email": "user@email.com",
            "user_id": 7,
            "user_name": "First Last"
        }

I took a look at our data and for our dataset, standardLibVersion is always an integer. That said, the Tines API returns it as a json string, so keeping it as a keyword may be safest to prevent any future issues.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (2/2)	💚
Files	100.0% (2/2)	💚 3.182
Classes	100.0% (2/2)	💚 3.182
Methods	91.304% (21/23)	👍 0.146
Lines	82.474% (160/194)	👎 -9.552
Conditionals	100.0% (0/0)	💚

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

Package tines - 0.0.4 containing this change is available at https://epr.elastic.co/search?package=tines