okta: do not remove event.original in main ingest

[efd6]

Proposed commit message

See title.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• For security-service-integrations: retain event.original value upon pipeline errors #12067

Screenshots

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 006d383

History

• 💔 Build #19581 failed 3ac0cfd

cc @efd6

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[chrisberkhout]

So if you provide an event with message and event.original, the event.original will be used and the message will be discarded.

Before this change it was the same, except the message field wouldn't be removed.

I the change is fine.

I wonder if we should be more consistent about using event.original as the source, and any other conventions necessary to make it easier to reprocess events.

[efd6]

I wonder if we should be more consistent about using event.original as the source, and any other conventions necessary to make it easier to reprocess events.

I would like this. I think it's something that we should discuss for the integrations review document.

[elastic-vault-github-plugin-prod]

Package okta - 3.4.0 containing this change is available at https://epr.elastic.co/package/okta/3.4.0/