graphactivitylogs: Fix client|source.geo.location mapping

[zmoog]

Proposed commit message

Align client|source.geo.location fields to ECS mapping.

Users reported mapping exceptions due to Elasticsearch mapping theclient|source.geo.location fields as object instead of geo_point. See #10848 for more.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Related issues

• Relates Verify mapping problems after migrating to ecs@mappings #10848

[zmoog]

According to the Client Fields and Source Fields ECS reference, we should map client.geo.location and source.geo.location using the geo_point type.

However, the packages/azure/data_stream/graphactivitylogs/fields/ecs.yml has the following mapping:

- name: client.geo.location.lat
  external: ecs
- name: client.geo.location.lon
  external: ecs
- name: source.geo.location.lat
  external: ecs
- name: source.geo.location.lon
  external: ecs

That causes Elasticsearch to map the client.geo.location and source.geo.location fields as object.

We should probably change the mapping to:

- name: client.geo.location
  external: ecs
- name: source.geo.location
  external: ecs

To align these fields with ECS and produce the expected geo_point mapping.

@kcreddy, are there specific reasons to use the *.lat|.lon mapping?

[elasticmachine]

🚀 Benchmarks report

Package azure 👍(6) 💚(4) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
provisioning	3225.81	2398.08	-827.73 (-25.66%)	💔

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[efd6]

This needs a changelog and manifest update.

[muthu-mps]

code owner approval.

[kcreddy]

@kcreddy, are there specific reasons to use the *.lat|.lon mapping?

I don't see one. Must be a miss from previous datastreams which missed this fix.
Thanks for fixing 👍🏼

[andrewkroh]

You labeled the PR as a bug and the patch version was incremented so all signals suggest this should be type: bugfix instead of enhancement. Can you confirm the intention.

[zmoog]

Hey Andrew, thanks for the heads up. This is a bug; updating the changelog classification accordingly.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 605df75

History

• 💚 Build #15815 succeeded 1c41326
• 💚 Build #15797 succeeded 50cac0e

cc @zmoog

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube