o365: tolerate missing cursor elements when advancing

WIP This should never happen, but there is not yet enough information to determine the cause. It may be that we want to raise a health status update in situations like this. My guess is that there was an error, the cursor was damaged and we end up not having parts of the cursor. The question is "How?"

Author: efd6

packages/o365/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.26.2"
+ changes:
+ - description: Tolerate missing cursor elements when advancing.
+ type: bugfix
+ link: https://github.com/elastic/integrations/pull/
 - version: "2.26.1"
  changes:
  - description: Ensure that cursors are not updated to times in the future.

packages/o365/data_stream/audit/agent/stream/cel.yml.hbs

@@ -456,8 +456,9 @@ program: |-
  (
  // Ensure that we bring the current type up to the current time,
  // even if we did not get any content for the query period.
- timestamp(state.cursor.last_for[state.work.curr_type.to_lower()]) < now - duration("1h") &&
- !state.work.todo_type.exists(t, t == state.work.curr_type)
+ has(state.?work.curr_type) && state.?cursor.last_for.optMap(l,
+ timestamp(l[state.work.curr_type.to_lower()]) < now - duration("1h")
+ ).orValue(false) && !state.work.todo_type.exists(t, t == state.work.curr_type)
  ) ?
  state.with(
  {

packages/o365/manifest.yml

@@ -1,6 +1,6 @@
 name: o365
 title: Microsoft Office 365
-version: "2.26.1"
+version: "2.26.2"
 description: Collect logs from Microsoft Office 365 with Elastic Agent.
 type: integration
 format_version: "3.2.3"