Workaround issue with missing dynamic mapping in tines package (#12082)

No dynamic mapping was being generated for
tines.audit_log.inputs.inputs.options.*, and this package uses the
tines.audit_log.inputs.inputs.options field directly, without having any
mapping for it or its sub-properties.

The workaround ensures that there is a mapping for
tines.audit_log.inputs.inputs.* that serves for
tines.audit_log.inputs.inputs.options as well as for its subobjects.

The configured dynamic mapping was not being generated due to some issue in
Fleet that we are investigating.

We detected this issue while refactoring field mappings tests in
elastic-package, more about this in elastic/elastic-package#2214[1].

[1]elastic/elastic-package#2214 (comment)

Co-authored-by: Dan Kortschak <[email protected]>

packages/tines/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.14.1"
+  changes:
+    - description: Workaround missing dynamic template for options fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/12082
 - version: "1.14.0"
   changes:
     - description: Do not remove `event.original` in main ingest pipeline.

packages/tines/data_stream/audit_logs/fields/fields.yml

@@ -142,10 +142,6 @@
                   type: keyword
                 - name: oauthUrl
                   type: keyword
-                - name: options
-                  type: object
-                  object_type: keyword
-                  object_type_mapping_type: "*"
                 - name: options.createFormEmptyState
                   type: boolean
                 - name: readAccess
@@ -166,6 +162,8 @@
                   type: long
                 - name: value
                   type: keyword
+                - name: "*"
+                  type: keyword
         - name: request_ip
           type: keyword
           description: The IP Address the operation was triggered from

packages/tines/docs/README.md

@@ -76,6 +76,7 @@ All fields ingested to this data stream are stored under `tines.audit_log` as ea
 | tines.audit_log.inputs.actionIds |  | long |
 | tines.audit_log.inputs.diagramNoteIds |  | long |
 | tines.audit_log.inputs.fieldId |  | long |
+| tines.audit_log.inputs.inputs.\* |  | keyword |
 | tines.audit_log.inputs.inputs.actionId |  | long |
 | tines.audit_log.inputs.inputs.actionIds |  | long |
 | tines.audit_log.inputs.inputs.actions.actionId |  | long |
@@ -125,7 +126,6 @@ All fields ingested to this data stream are stored under `tines.audit_log` as ea
 | tines.audit_log.inputs.inputs.oauthScope |  | keyword |
 | tines.audit_log.inputs.inputs.oauthTokenUrl |  | keyword |
 | tines.audit_log.inputs.inputs.oauthUrl |  | keyword |
-| tines.audit_log.inputs.inputs.options |  | object |
 | tines.audit_log.inputs.inputs.options.createFormEmptyState |  | boolean |
 | tines.audit_log.inputs.inputs.readAccess |  | keyword |
 | tines.audit_log.inputs.inputs.required |  | boolean |

packages/tines/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 3.2.1
 name: tines
 title: "Tines"
-version: "1.14.0"
+version: "1.14.1"
 description: "Tines Logs & Time Saved Reports"
 type: integration
 categories: