Microsoft Defender for Endpoint: Logstash compatibility. Remove message field if event.original exists

[haam3r]

• Bug

Proposed commit message

In instances where the event.original field already exists when received by the ingest pipeline, such as when the sender is Logstash with ecs_compatibility set to either v1 or v8, not specifically removing the message field breaks the rename processor where json.title is moved to the message field.

To solve that issue, this PR adds a separate remove processor that remove the message field, if the event.original field is present. This then allows the later json.title rename processor to work.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

[cla-checker-service]

💚 CLA has been signed

[efd6]

Please add a changelog entry and bump the version in the manifest.

[haam3r]

Please add a changelog entry and bump the version in the manifest.

Done

[efd6]

/test

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 28dce4b

[elastic-sonarqube]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

Package microsoft_defender_endpoint - 2.24.2 containing this change is available at https://epr.elastic.co/search?package=microsoft_defender_endpoint