From 1c4aab7b493fc679dd87fadee95e998aad6ce1f1 Mon Sep 17 00:00:00 2001 From: Vatsal Desai Date: Wed, 22 Jul 2026 19:02:57 -0700 Subject: [PATCH] github: set subobjects:false on ruleset_conditions parameter groups Co-authored-by: Cursor --- packages/github/changelog.yml | 5 + .../data_stream/audit/fields/fields.yml | 144 ++++++++++-------- packages/github/docs/README.md | 8 + packages/github/manifest.yml | 2 +- 4 files changed, 94 insertions(+), 65 deletions(-) diff --git a/packages/github/changelog.yml b/packages/github/changelog.yml index 2246432b0a4..0f29eaca0ec 100644 --- a/packages/github/changelog.yml +++ b/packages/github/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "2.25.1" + changes: + - description: Set `subobjects` to `false` on the audit `ruleset_conditions*` `parameters`/`old_parameters` objects. For `repository_property` targets GitHub sends `include`/`exclude` as `{name, source, property_values}` objects instead of repository-name strings; the object shape collided with the `keyword` mapping and was rejected to the failure store. Disabling subobjects keeps the existing `include`/`exclude`/`repository_ids` keyword fields for the string form while letting object-form attributes map as dotted keyword leaves (`include.name`, and so on). + type: bugfix + link: https://github.com/elastic/integrations/pull/20306 - version: "2.25.0" changes: - description: Use new `release` field for agentless deployment mode to establish as beta. diff --git a/packages/github/data_stream/audit/fields/fields.yml b/packages/github/data_stream/audit/fields/fields.yml index 367c479c4ed..9617b8ba78e 100644 --- a/packages/github/data_stream/audit/fields/fields.yml +++ b/packages/github/data_stream/audit/fields/fields.yml @@ -250,23 +250,27 @@ - name: target type: keyword - name: parameters - type: group - fields: - - name: exclude - type: keyword - - name: include - type: keyword - - name: repository_ids - type: keyword + type: object + subobjects: false + object_type: keyword + object_type_mapping_type: "*" + - name: parameters.exclude + type: keyword + - name: parameters.include + type: keyword + - name: parameters.repository_ids + type: keyword - name: old_parameters - type: group - fields: - - name: exclude - type: keyword - - name: include - type: keyword - - name: repository_ids - type: keyword + type: object + subobjects: false + object_type: keyword + object_type_mapping_type: "*" + - name: old_parameters.exclude + type: keyword + - name: old_parameters.include + type: keyword + - name: old_parameters.repository_ids + type: keyword - name: ruleset_conditions_added type: group description: >- @@ -277,23 +281,27 @@ - name: target type: keyword - name: parameters - type: group - fields: - - name: exclude - type: keyword - - name: include - type: keyword - - name: repository_ids - type: keyword + type: object + subobjects: false + object_type: keyword + object_type_mapping_type: "*" + - name: parameters.exclude + type: keyword + - name: parameters.include + type: keyword + - name: parameters.repository_ids + type: keyword - name: old_parameters - type: group - fields: - - name: exclude - type: keyword - - name: include - type: keyword - - name: repository_ids - type: keyword + type: object + subobjects: false + object_type: keyword + object_type_mapping_type: "*" + - name: old_parameters.exclude + type: keyword + - name: old_parameters.include + type: keyword + - name: old_parameters.repository_ids + type: keyword - name: ruleset_conditions_deleted type: group description: >- @@ -304,23 +312,27 @@ - name: target type: keyword - name: parameters - type: group - fields: - - name: exclude - type: keyword - - name: include - type: keyword - - name: repository_ids - type: keyword + type: object + subobjects: false + object_type: keyword + object_type_mapping_type: "*" + - name: parameters.exclude + type: keyword + - name: parameters.include + type: keyword + - name: parameters.repository_ids + type: keyword - name: old_parameters - type: group - fields: - - name: exclude - type: keyword - - name: include - type: keyword - - name: repository_ids - type: keyword + type: object + subobjects: false + object_type: keyword + object_type_mapping_type: "*" + - name: old_parameters.exclude + type: keyword + - name: old_parameters.include + type: keyword + - name: old_parameters.repository_ids + type: keyword - name: ruleset_conditions_updated type: group description: >- @@ -331,23 +343,27 @@ - name: target type: keyword - name: parameters - type: group - fields: - - name: exclude - type: keyword - - name: include - type: keyword - - name: repository_ids - type: keyword + type: object + subobjects: false + object_type: keyword + object_type_mapping_type: "*" + - name: parameters.exclude + type: keyword + - name: parameters.include + type: keyword + - name: parameters.repository_ids + type: keyword - name: old_parameters - type: group - fields: - - name: exclude - type: keyword - - name: include - type: keyword - - name: repository_ids - type: keyword + type: object + subobjects: false + object_type: keyword + object_type_mapping_type: "*" + - name: old_parameters.exclude + type: keyword + - name: old_parameters.include + type: keyword + - name: old_parameters.repository_ids + type: keyword - name: secret_type type: keyword - name: secret_type_display_name diff --git a/packages/github/docs/README.md b/packages/github/docs/README.md index 03c533fefe8..67de25a7089 100644 --- a/packages/github/docs/README.md +++ b/packages/github/docs/README.md @@ -148,33 +148,41 @@ For Filebeat input documentation, refer to the following pages: | github.ruleset_bypass_actors_updated.bypass_mode | | keyword | | github.ruleset_bypass_actors_updated.id | | long | | github.ruleset_conditions.id | | long | +| github.ruleset_conditions.old_parameters | | object | | github.ruleset_conditions.old_parameters.exclude | | keyword | | github.ruleset_conditions.old_parameters.include | | keyword | | github.ruleset_conditions.old_parameters.repository_ids | | keyword | +| github.ruleset_conditions.parameters | | object | | github.ruleset_conditions.parameters.exclude | | keyword | | github.ruleset_conditions.parameters.include | | keyword | | github.ruleset_conditions.parameters.repository_ids | | keyword | | github.ruleset_conditions.target | | keyword | | github.ruleset_conditions_added.id | | long | +| github.ruleset_conditions_added.old_parameters | | object | | github.ruleset_conditions_added.old_parameters.exclude | | keyword | | github.ruleset_conditions_added.old_parameters.include | | keyword | | github.ruleset_conditions_added.old_parameters.repository_ids | | keyword | +| github.ruleset_conditions_added.parameters | | object | | github.ruleset_conditions_added.parameters.exclude | | keyword | | github.ruleset_conditions_added.parameters.include | | keyword | | github.ruleset_conditions_added.parameters.repository_ids | | keyword | | github.ruleset_conditions_added.target | | keyword | | github.ruleset_conditions_deleted.id | | long | +| github.ruleset_conditions_deleted.old_parameters | | object | | github.ruleset_conditions_deleted.old_parameters.exclude | | keyword | | github.ruleset_conditions_deleted.old_parameters.include | | keyword | | github.ruleset_conditions_deleted.old_parameters.repository_ids | | keyword | +| github.ruleset_conditions_deleted.parameters | | object | | github.ruleset_conditions_deleted.parameters.exclude | | keyword | | github.ruleset_conditions_deleted.parameters.include | | keyword | | github.ruleset_conditions_deleted.parameters.repository_ids | | keyword | | github.ruleset_conditions_deleted.target | | keyword | | github.ruleset_conditions_updated.id | | long | +| github.ruleset_conditions_updated.old_parameters | | object | | github.ruleset_conditions_updated.old_parameters.exclude | | keyword | | github.ruleset_conditions_updated.old_parameters.include | | keyword | | github.ruleset_conditions_updated.old_parameters.repository_ids | | keyword | +| github.ruleset_conditions_updated.parameters | | object | | github.ruleset_conditions_updated.parameters.exclude | | keyword | | github.ruleset_conditions_updated.parameters.include | | keyword | | github.ruleset_conditions_updated.parameters.repository_ids | | keyword | diff --git a/packages/github/manifest.yml b/packages/github/manifest.yml index 40351b17a53..0e4257c5d38 100644 --- a/packages/github/manifest.yml +++ b/packages/github/manifest.yml @@ -1,6 +1,6 @@ name: github title: GitHub -version: "2.25.0" +version: "2.25.1" description: Collect logs from GitHub with Elastic Agent. type: integration format_version: "3.4.0"