ssi_all: add "preserve_original_event" tag to documents with event.ki…

…nd set to "pipeline_error"

[git-generate]
for f in $(
        (
                for p in $(
                        yq 'select(.owner.github == "elastic/security-service-integrations")|.name' packages/**/manifest.yml \
                        | grep -v -- ---
                ); do
                        rg -l -g 'default.yml' "value: pipeline_error" packages/$p
                done
        )|sort|uniq
); do
        (grep 'value: preserve_original_event' $f >/dev/null 2>&1) && continue
        perl -i -pe 'BEGIN{undef $/;} s/([a-z:"])
( *)(- set:.*value: pipeline_error)/$1
$2$3
$2- append:
$2    field: tags
$2    value: preserve_original_event
$2    allow_duplicates: true/smg' $f
done
for p in $(git diff --name-only HEAD~1|cut -d/ -f1,2|sort|uniq); do
    (
            cd $p
            elastic-package changelog add \
                    --description 'Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error".' \
                    --type enhancement \
                    --next minor \
                    --link elastic#12046
    )>/dev/null 2>&1
done

packages/1password/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.31.0"
+  changes:
+    - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error".
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/12046
 - version: "1.30.2"
   changes:
     - description: Unify the use of `user.full_name` and `user.name` in all data streams.

packages/1password/data_stream/audit_events/elasticsearch/ingest_pipeline/default.yml

@@ -138,6 +138,10 @@ on_failure:
   - set:
       field: event.kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true
   - append:
       field: error.message
       value: '{{{ _ingest.on_failure_message }}}'

packages/1password/data_stream/item_usages/elasticsearch/ingest_pipeline/default.yml

@@ -134,6 +134,10 @@ on_failure:
   - set:
       field: event.kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true
   - append:
       field: error.message
       value: '{{{ _ingest.on_failure_message }}}'

packages/1password/data_stream/signin_attempts/elasticsearch/ingest_pipeline/default.yml

@@ -148,6 +148,10 @@ on_failure:
   - set:
       field: event.kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true
   - append:
       field: error.message
       value: '{{{ _ingest.on_failure_message }}}'

packages/1password/manifest.yml

@@ -1,7 +1,7 @@
 format_version: "3.0.2"
 name: 1password
 title: "1Password"
-version: "1.30.2"
+version: "1.31.0"
 description: Collect logs from 1Password with Elastic Agent.
 type: integration
 categories:

packages/abnormal_security/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.1.0"
+  changes:
+    - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error".
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/12046
 - version: "1.0.1"
   changes:
     - description: Fix broken link for the Abnormal Security integration.

packages/abnormal_security/data_stream/ai_security_mailbox/elasticsearch/ingest_pipeline/default.yml

@@ -283,3 +283,7 @@ on_failure:
       field: event.kind
       tag: set_pipeline_error_to_event_kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true

packages/abnormal_security/data_stream/audit/elasticsearch/ingest_pipeline/default.yml

@@ -259,3 +259,7 @@ on_failure:
       field: event.kind
       tag: set_pipeline_error_to_event_kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true

packages/abnormal_security/data_stream/case/elasticsearch/ingest_pipeline/default.yml

@@ -222,3 +222,7 @@ on_failure:
       field: event.kind
       tag: set_pipeline_error_to_event_kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true

packages/abnormal_security/data_stream/threat/elasticsearch/ingest_pipeline/default.yml

@@ -543,3 +543,7 @@ on_failure:
       field: event.kind
       tag: set_pipeline_error_to_event_kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true

packages/abnormal_security/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 3.2.1
 name: abnormal_security
 title: Abnormal Security
-version: 1.0.1
+version: 1.1.0
 description: Collect logs from Abnormal Security with Elastic Agent.
 type: integration
 categories:

packages/akamai/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.27.0"
+  changes:
+    - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error".
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/12046
 - version: "2.26.0"
   changes:
     - description: Handle input leniently.

packages/akamai/data_stream/siem/elasticsearch/ingest_pipeline/default.yml

@@ -545,6 +545,10 @@ on_failure:
   - set:
       field: event.kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true
   - append:
       field: error.message
       value: >-

packages/akamai/manifest.yml

@@ -1,6 +1,6 @@
 name: akamai
 title: Akamai
-version: "2.26.0"
+version: "2.27.0"
 description: Collect logs from Akamai with Elastic Agent.
 type: integration
 format_version: "3.0.2"

packages/amazon_security_lake/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.1.0"
+  changes:
+    - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error".
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/12046
 - version: "2.0.0"
   changes:
     - description: Updated to support OCSF v1.1.0. with major pipeline rework and dynamic mapping support.

packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/default.yml

@@ -1453,3 +1453,7 @@ on_failure:
   - set:
       field: event.kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true

packages/amazon_security_lake/manifest.yml

@@ -1,7 +1,7 @@
 format_version: "3.0.3"
 name: amazon_security_lake
 title: Amazon Security Lake
-version: "2.0.0"
+version: "2.1.0"
 description: Collect logs from Amazon Security Lake with Elastic Agent.
 type: integration
 categories: ["aws", "security"]

packages/atlassian_bitbucket/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.3.0"
+  changes:
+    - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error".
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/12046
 - version: "2.2.2"
   changes:
     - description: Use triple-brace Mustache templating when referencing variables in ingest pipelines.

packages/atlassian_bitbucket/data_stream/audit/elasticsearch/ingest_pipeline/default.yml

@@ -443,6 +443,10 @@ on_failure:
   - set:
       field: event.kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true
   - append:
       field: error.message
       value: '{{{ _ingest.on_failure_message }}}'

packages/atlassian_bitbucket/manifest.yml

@@ -1,7 +1,7 @@
 format_version: "3.0.2"
 name: atlassian_bitbucket
 title: Atlassian Bitbucket
-version: "2.2.2"
+version: "2.3.0"
 description: Collect logs from Atlassian Bitbucket with Elastic Agent.
 type: integration
 categories:

packages/atlassian_confluence/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.27.0"
+  changes:
+    - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error".
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/12046
 - version: "1.26.1"
   changes:
     - description: Use triple-brace Mustache templating when referencing variables in ingest pipelines.

packages/atlassian_confluence/data_stream/audit/elasticsearch/ingest_pipeline/default.yml

@@ -434,6 +434,10 @@ on_failure:
   - set:
       field: event.kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true
   - append:
       field: error.message
       value: '{{{ _ingest.on_failure_message }}}'

packages/atlassian_confluence/manifest.yml

@@ -1,7 +1,7 @@
 format_version: "3.0.2"
 name: atlassian_confluence
 title: Atlassian Confluence
-version: "1.26.1"
+version: "1.27.0"
 description: Collect logs from Atlassian Confluence with Elastic Agent.
 type: integration
 categories:

packages/atlassian_jira/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.28.0"
+  changes:
+    - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error".
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/12046
 - version: "1.27.2"
   changes:
     - description: Use triple-brace Mustache templating when referencing variables in ingest pipelines.

packages/atlassian_jira/data_stream/audit/elasticsearch/ingest_pipeline/default.yml

@@ -413,6 +413,10 @@ on_failure:
   - set:
       field: event.kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true
   - append:
       field: error.message
       value: '{{{ _ingest.on_failure_message }}}'

packages/atlassian_jira/manifest.yml

@@ -1,7 +1,7 @@
 format_version: "3.0.2"
 name: atlassian_jira
 title: Atlassian Jira
-version: "1.27.2"
+version: "1.28.0"
 description: Collect logs from Atlassian Jira with Elastic Agent.
 type: integration
 categories:

packages/auth0/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.19.0"
+  changes:
+    - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error".
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/12046
 - version: "1.18.1"
   changes:
     - description: Fix dashboard visualisations containing empty data.

packages/auth0/data_stream/logs/elasticsearch/ingest_pipeline/default.yml

@@ -1105,6 +1105,10 @@ on_failure:
 - set:
     field: event.kind
     value: pipeline_error
+- append:
+    field: tags
+    value: preserve_original_event
+    allow_duplicates: true
 - append:
     field: error.message
     value: '{{{ _ingest.on_failure_message }}}'

packages/auth0/manifest.yml

@@ -1,7 +1,7 @@
 format_version: "3.0.2"
 name: auth0
 title: "Auth0"
-version: "1.18.1"
+version: "1.19.0"
 description: Collect logs from Auth0 with Elastic Agent.
 type: integration
 categories:

packages/authentik/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.1.0"
+  changes:
+    - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error".
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/12046
 - version: "1.0.0"
   changes:
     - description: Release package as GA.

packages/authentik/data_stream/event/elasticsearch/ingest_pipeline/default.yml

@@ -520,3 +520,7 @@ on_failure:
       field: event.kind
       tag: set_pipeline_error_to_event_kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true

packages/authentik/data_stream/group/elasticsearch/ingest_pipeline/default.yml

@@ -160,3 +160,7 @@ on_failure:
       field: event.kind
       tag: set_pipeline_error_to_event_kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true

packages/authentik/data_stream/user/elasticsearch/ingest_pipeline/default.yml

@@ -218,3 +218,7 @@ on_failure:
       field: event.kind
       tag: set_pipeline_error_to_event_kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true

packages/authentik/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 3.2.1
 name: authentik
 title: authentik
-version: 1.0.0
+version: 1.1.0
 description: Collect logs from authentik with Elastic Agent.
 type: integration
 categories:

packages/aws_bedrock/changelog.yml

@@ -1,3 +1,8 @@
+- version: "0.16.0"
+  changes:
+    - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error".
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/12046
 - version: "0.15.0"
   changes:
     - description: Retain contextualGroundingPolicy check details.

packages/aws_bedrock/data_stream/runtime/elasticsearch/ingest_pipeline/default.yml

@@ -69,6 +69,10 @@ on_failure:
   - set:
       field: event.kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true
   - set:
       field: error.message
       value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'

packages/aws_bedrock/manifest.yml

@@ -3,7 +3,7 @@ name: aws_bedrock
 title: Amazon Bedrock
 description: Collect Amazon Bedrock model invocation logs and runtime metrics with Elastic Agent.
 type: integration
-version: "0.15.0"
+version: "0.16.0"
 categories:
   - aws
 conditions:

packages/azure_frontdoor/changelog.yml

@@ -1,3 +1,8 @@
+- version: "2.1.0"
+  changes:
+    - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error".
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/12046
 - version: "2.0.1"
   changes:
     - description: Use triple-brace Mustache templating when referencing variables in ingest pipelines.

packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml

@@ -342,6 +342,10 @@ on_failure:
   - set:
       field: event.kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true
   - append:
       field: error.message
       value: '{{{ _ingest.on_failure_message }}}'

packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml

@@ -265,6 +265,10 @@ on_failure:
   - set:
       field: event.kind
       value: pipeline_error
+  - append:
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: true
   - append:
       field: error.message
       value: '{{{ _ingest.on_failure_message }}}'

packages/azure_frontdoor/manifest.yml

@@ -1,7 +1,7 @@
 format_version: "3.0.2"
 name: azure_frontdoor
 title: "Azure Frontdoor"
-version: "2.0.1"
+version: "2.1.0"
 description: "This Elastic integration collects logs from Azure Frontdoor."
 type: integration
 categories: