o365: fix mappings for dynamically mapped fields

[efd6]

What does this PR do?

• o365.audit.ExchangeMetaData.*
• o365.audit.ExceptionInfo.*
• o365.audit.ExtendedProperties.*
• o365.audit.Item.*
• o365.audit.Item.*.*
• o365.audit.ModifiedProperties.*.*
• o365.audit.Parameters.*
• o365.audit.SharePointMetaData.*

Remove o365.audit.Members.*; o365.audit.Members is already defined as a flattened field.

After this change the dynamic mappings are:

      "dynamic_templates": [
        {
          "container.labels": {
            "path_match": "container.labels.*",
            "match_mapping_type": "string",
            "mapping": {
              "type": "keyword"
            }
          }
        },
        {
          "o365.audit.ExchangeMetaData.*": {
            "path_match": "o365.audit.ExchangeMetaData.*",
            "match_mapping_type": "long",
            "mapping": {
              "type": "long"
            }
          }
        },
        {
          "o365.audit.ExceptionInfo.*": {
            "path_match": "o365.audit.ExceptionInfo.*",
            "mapping": {
              "type": "keyword"
            }
          }
        },
        {
          "o365.audit.ExtendedProperties.*": {
            "path_match": "o365.audit.ExtendedProperties.*",
            "mapping": {
              "type": "keyword"
            }
          }
        },
        {
          "o365.audit.Item.*.*": {
            "path_match": "o365.audit.Item.*.*",
            "mapping": {
              "type": "keyword"
            }
          }
        },
        {
          "o365.audit.ModifiedProperties.*.*": {
            "path_match": "o365.audit.ModifiedProperties.*.*",
            "mapping": {
              "type": "keyword"
            }
          }
        },
        {
          "o365.audit.Parameters.*": {
            "path_match": "o365.audit.Parameters.*",
            "mapping": {
              "type": "keyword"
            }
          }
        },
        {
          "o365.audit.SharePointMetaData.*": {
            "path_match": "o365.audit.SharePointMetaData.*",
            "mapping": {
              "type": "keyword"
            }
          }
        },
        {
          "strings_as_keyword": {
            "match_mapping_type": "string",
            "mapping": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        }
      ],

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Closes [o365] Incorrect dynamic field definitions #7975

Screenshots

[efd6]

From the dynamic templates, it looks like this is not necessary.

[andrewkroh]

Why didn't it show up in the dynamic_templates?

[efd6]

Yeah, that's why I'm confused.

[efd6]

Maybe in a bug in package-spec?

[andrewkroh]

I would suspect Fleet. Like perhaps the dedupFields function (https://github.com/elastic/kibana/blob/ed8225f7bcb9f8d16b2241c8de26cd8103fcb942/x-pack/plugins/fleet/server/services/epm/fields/field.ts#L124). Given that this would appear to be a parent of the Item.*.* I wonder if it is being ignored.

[andrewkroh]

Logged an issue at elastic/kibana#167553.

[andrewkroh]

We can move forward without this being in the template because it's only purpose was to satisfy the field validation (all fields found in test cases must be defined) within elastic-package and it still does. The default dynamic mappings will work fine.

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-09-26T23:57:04.456+0000

• Duration: 19 min 9 sec

Test stats 🧪

Test	Results
Failed	0
Passed	25
Skipped	0
Total	25

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (1/1)	💚
Files	100.0% (1/1)	💚
Classes	100.0% (1/1)	💚
Methods	100.0% (16/16)	💚 7.407
Lines	80.994% (733/905)	👎 -6.683
Conditionals	100.0% (0/0)	💚

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

This object can also contain date fields

For these cases I assume the data has always been mapped as keyword because Fleet using "date_detection": false in templates. So this isn't a regression.

[efd6]

Yep, this is just a note for why it is.