[github] Allow polymorphic audit ruleset_conditions parameters via subobjects:false

packages/github/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.25.1"
+  changes:
+    - description: Set `subobjects` to `false` on the audit `ruleset_conditions*` `parameters`/`old_parameters` objects. For `repository_property` targets GitHub sends `include`/`exclude` as `{name, source, property_values}` objects instead of repository-name strings; the object shape collided with the `keyword` mapping and was rejected to the failure store. Disabling subobjects keeps the existing `include`/`exclude`/`repository_ids` keyword fields for the string form while letting object-form attributes map as dotted keyword leaves (`include.name`, and so on).
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20306
 - version: "2.25.0"
   changes:
     - description: Use new `release` field for agentless deployment mode to establish as beta.

packages/github/data_stream/audit/fields/fields.yml

@@ -250,23 +250,27 @@
         - name: target
           type: keyword
         - name: parameters
-          type: group
-          fields:
-            - name: exclude
-              type: keyword
-            - name: include
-              type: keyword
-            - name: repository_ids
-              type: keyword
+          type: object
+          subobjects: false
+          object_type: keyword
+          object_type_mapping_type: "*"
+        - name: parameters.exclude
+          type: keyword
+        - name: parameters.include
+          type: keyword
+        - name: parameters.repository_ids
+          type: keyword
         - name: old_parameters
-          type: group
-          fields:
-            - name: exclude
-              type: keyword
-            - name: include
-              type: keyword
-            - name: repository_ids
-              type: keyword
+          type: object
+          subobjects: false
+          object_type: keyword
+          object_type_mapping_type: "*"
+        - name: old_parameters.exclude
+          type: keyword
+        - name: old_parameters.include
+          type: keyword
+        - name: old_parameters.repository_ids
+          type: keyword
     - name: ruleset_conditions_added
       type: group
       description: >-
@@ -277,23 +281,27 @@
         - name: target
           type: keyword
         - name: parameters
-          type: group
-          fields:
-            - name: exclude
-              type: keyword
-            - name: include
-              type: keyword
-            - name: repository_ids
-              type: keyword
+          type: object
+          subobjects: false
+          object_type: keyword
+          object_type_mapping_type: "*"
+        - name: parameters.exclude
+          type: keyword
+        - name: parameters.include
+          type: keyword
+        - name: parameters.repository_ids
+          type: keyword
         - name: old_parameters
-          type: group
-          fields:
-            - name: exclude
-              type: keyword
-            - name: include
-              type: keyword
-            - name: repository_ids
-              type: keyword
+          type: object
+          subobjects: false
+          object_type: keyword
+          object_type_mapping_type: "*"
+        - name: old_parameters.exclude
+          type: keyword
+        - name: old_parameters.include
+          type: keyword
+        - name: old_parameters.repository_ids
+          type: keyword
     - name: ruleset_conditions_deleted
       type: group
       description: >-
@@ -304,23 +312,27 @@
         - name: target
           type: keyword
         - name: parameters
-          type: group
-          fields:
-            - name: exclude
-              type: keyword
-            - name: include
-              type: keyword
-            - name: repository_ids
-              type: keyword
+          type: object
+          subobjects: false
+          object_type: keyword
+          object_type_mapping_type: "*"
+        - name: parameters.exclude
+          type: keyword
+        - name: parameters.include
+          type: keyword
+        - name: parameters.repository_ids
+          type: keyword
         - name: old_parameters
-          type: group
-          fields:
-            - name: exclude
-              type: keyword
-            - name: include
-              type: keyword
-            - name: repository_ids
-              type: keyword
+          type: object
+          subobjects: false
+          object_type: keyword
+          object_type_mapping_type: "*"
+        - name: old_parameters.exclude
+          type: keyword
+        - name: old_parameters.include
+          type: keyword
+        - name: old_parameters.repository_ids
+          type: keyword
     - name: ruleset_conditions_updated
       type: group
       description: >-
@@ -331,23 +343,27 @@
         - name: target
           type: keyword
         - name: parameters
-          type: group
-          fields:
-            - name: exclude
-              type: keyword
-            - name: include
-              type: keyword
-            - name: repository_ids
-              type: keyword
+          type: object
+          subobjects: false
+          object_type: keyword
+          object_type_mapping_type: "*"
+        - name: parameters.exclude
+          type: keyword
+        - name: parameters.include
+          type: keyword
+        - name: parameters.repository_ids
+          type: keyword
         - name: old_parameters
-          type: group
-          fields:
-            - name: exclude
-              type: keyword
-            - name: include
-              type: keyword
-            - name: repository_ids
-              type: keyword
+          type: object
+          subobjects: false
+          object_type: keyword
+          object_type_mapping_type: "*"
+        - name: old_parameters.exclude
+          type: keyword
+        - name: old_parameters.include
+          type: keyword
+        - name: old_parameters.repository_ids
+          type: keyword
     - name: secret_type
       type: keyword
     - name: secret_type_display_name

packages/github/docs/README.md

@@ -148,33 +148,41 @@ For Filebeat input documentation, refer to the following pages:
 | github.ruleset_bypass_actors_updated.bypass_mode |  | keyword |
 | github.ruleset_bypass_actors_updated.id |  | long |
 | github.ruleset_conditions.id |  | long |
+| github.ruleset_conditions.old_parameters |  | object |
 | github.ruleset_conditions.old_parameters.exclude |  | keyword |
 | github.ruleset_conditions.old_parameters.include |  | keyword |
 | github.ruleset_conditions.old_parameters.repository_ids |  | keyword |
+| github.ruleset_conditions.parameters |  | object |
 | github.ruleset_conditions.parameters.exclude |  | keyword |
 | github.ruleset_conditions.parameters.include |  | keyword |
 | github.ruleset_conditions.parameters.repository_ids |  | keyword |
 | github.ruleset_conditions.target |  | keyword |
 | github.ruleset_conditions_added.id |  | long |
+| github.ruleset_conditions_added.old_parameters |  | object |
 | github.ruleset_conditions_added.old_parameters.exclude |  | keyword |
 | github.ruleset_conditions_added.old_parameters.include |  | keyword |
 | github.ruleset_conditions_added.old_parameters.repository_ids |  | keyword |
+| github.ruleset_conditions_added.parameters |  | object |
 | github.ruleset_conditions_added.parameters.exclude |  | keyword |
 | github.ruleset_conditions_added.parameters.include |  | keyword |
 | github.ruleset_conditions_added.parameters.repository_ids |  | keyword |
 | github.ruleset_conditions_added.target |  | keyword |
 | github.ruleset_conditions_deleted.id |  | long |
+| github.ruleset_conditions_deleted.old_parameters |  | object |
 | github.ruleset_conditions_deleted.old_parameters.exclude |  | keyword |
 | github.ruleset_conditions_deleted.old_parameters.include |  | keyword |
 | github.ruleset_conditions_deleted.old_parameters.repository_ids |  | keyword |
+| github.ruleset_conditions_deleted.parameters |  | object |
 | github.ruleset_conditions_deleted.parameters.exclude |  | keyword |
 | github.ruleset_conditions_deleted.parameters.include |  | keyword |
 | github.ruleset_conditions_deleted.parameters.repository_ids |  | keyword |
 | github.ruleset_conditions_deleted.target |  | keyword |
 | github.ruleset_conditions_updated.id |  | long |
+| github.ruleset_conditions_updated.old_parameters |  | object |
 | github.ruleset_conditions_updated.old_parameters.exclude |  | keyword |
 | github.ruleset_conditions_updated.old_parameters.include |  | keyword |
 | github.ruleset_conditions_updated.old_parameters.repository_ids |  | keyword |
+| github.ruleset_conditions_updated.parameters |  | object |
 | github.ruleset_conditions_updated.parameters.exclude |  | keyword |
 | github.ruleset_conditions_updated.parameters.include |  | keyword |
 | github.ruleset_conditions_updated.parameters.repository_ids |  | keyword |

packages/github/manifest.yml

@@ -1,6 +1,6 @@
 name: github
 title: GitHub
-version: "2.25.0"
+version: "2.25.1"
 description: Collect logs from GitHub with Elastic Agent.
 type: integration
 format_version: "3.4.0"