[azure][activitylogs] add json processor to responseBody and requestBody

[stefans-elastic]

Proposed commit message

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Closes [Azure] Escaped JSON in azure.activitylogs.properties #15421

Screenshots

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[giorgi-imerlishvili-elastic]

Shouldn't it be snake case as well? Otherwise, LGTM

[stefans-elastic]

now the case of the fields isn't altered at all.

[lucian-ioan]

LGTM

[chemamartinez]

Just code owner approval as SSI owns application_gateway data stream.

[muthu-mps]

@stefans-elastic - Lets keep the requestBody and responseBody field names in the same format and not necessary to convert it to snake case as renaming would lead to breaking change.

[stefans-elastic]

@stefans-elastic - Lets keep the requestBody and responseBody field names in the same format and not necessary to convert it to snake case as renaming would lead to breaking change.

@muthu-mps to clarify: requestBody and responseBody field names remain the same, right? and how about the nested fields? For example should it be:
option 1

"requestBody": {
      "test_data": {
          "my_test": 123
      }
  },
  "responseBody": {
      "sku_test": {
          "my_name": "Standard_LRS"
      }
  }

or
option 2

"requestBody": {
      "testData": {
          "myTest": 123
      }
  },
  "responseBody": {
      "skuTest": {
          "myName": "Standard_LRS"
      }
  }

[muthu-mps]

@stefans-elastic - Lets keep the requestBody and responseBody field names in the same format and not necessary to convert it to snake case as renaming would lead to breaking change.

@muthu-mps to clarify: requestBody and responseBody field names remain the same, right? and how about the nested fields? For example should it be: option 1

"requestBody": {
      "test_data": {
          "my_test": 123
      }
  },
  "responseBody": {
      "sku_test": {
          "my_name": "Standard_LRS"
      }
  }

or option 2

"requestBody": {
      "testData": {
          "myTest": 123
      }
  },
  "responseBody": {
      "skuTest": {
          "myName": "Standard_LRS"
      }
  }

Same can be applied to nested fields as well. Converting the nested fields without converting base field would lead to naming inconsistency.

[stefans-elastic]

@muthu-mps the change has been implemented.

[muthu-mps]

Can we replace with actual field name? The values can have sample data but the field names should reflect the actual name. Same applies to requestBody.

[stefans-elastic]

found example of requestBody and responseBody and updated the test data

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: c34748d

History

• 💚 Build #33577 succeeded 7b2396d
• 💚 Build #33076 succeeded 31e9171
• 💚 Build #32979 succeeded affdb7e
• 💚 Build #32932 succeeded 80883f3
• 💚 Build #32898 succeeded c0f2398
• 💔 Build #32896 failed 049dea7

[tommyers-elastic]

LGTM

[elastic-vault-github-plugin-prod]

Package azure - 1.29.0 containing this change is available at https://epr.elastic.co/package/azure/1.29.0/

[leandrojmp]

Hello, just saw this update in the integration available and was checking the PR.

What is being changed here? the field azure.activitylogs.properties is mapped as flattened, so this is just parsing the json on the nested responseBody and requestBody but does not change any of the mappings, right?

[efd6]

@leandrojmp This ensures that the field is an object and not a string since apparently sometimes it is sent as a JSON marshaling of an object.