gcp: remove never-successful violation field renames

[efd6]

Proposed commit message

The rename refers to fields that do not exist in the type, and appears to
have been incorrectly added to the block handling PolicyViolationInfo.

The alternative would have been to add the following, but we already
document the current behaviour, so leaving this as is as unfortunate.

  - foreach:
      field: gcp.audit.policy_violation_info.violations
      ignore_missing: true
      ignore_failure: true
      processor:
        rename:
          field: _ingest._value.errorMessage
          target_field: _ingest._value.error_message
      if: ctx.gcp?.audit?.policy_violation_info?.violations instanceof List
  - foreach:
      field: gcp.audit.policy_violation_info.violations
      ignore_missing: true
      ignore_failure: true
      processor:
        rename:
          field: _ingest._value.checkedValue
          target_field: _ingest._value.checked_value
      if: ctx.gcp?.audit?.policy_violation_info?.violations instanceof List
  - foreach:
      field: gcp.audit.policy_violation_info.violations
      ignore_missing: true
      ignore_failure: true
      processor:
        rename:
          field: _ingest._value.policyType
          target_field: _ingest._value.policy_type
      if: ctx.gcp?.audit?.policy_violation_info?.violations instanceof List

[1]https://cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog#ViolationInfo

Thanks to @ishleenk17 for identifying this.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[chrisberkhout]

Not renames absent fields seems fine.

Not adding renames to change the case of actual fields seems fine since they're already provided and documented in the current form.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 3d74c6f

History

• 💚 Build #25479 succeeded 2050049

cc @efd6

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package gcp - 2.42.1 containing this change is available at https://epr.elastic.co/package/gcp/2.42.1/