google_workspace: Fix flaky test from as.asn and as.organization_name fields

[kcreddy]

Proposed commit message

Fix flaky test by renaming incorrect source.as.asn and source.as.organization_name fields as they are not part of ECS:

test case failed: one or more problems with fields found in documents: [0] field "source.as.asn" is undefined [1] field "source.as.organization_name" is undefined 

Renaming them to their ECS counter-parts should fix the issue.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

cd packages/google_workspace && elastic-package build && elastic-package stack up --version=8.16.0 -d -v && eval "$(elastic-package stack shellinit)" && elastic-package test pipeline --generate -v

--- Test results for package: google_workspace - START --- ╭──────────────────┬──────────────────────┬───────────┬──────────────────────────────────────────────────────────┬────────┬──────────────╮ │ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │ TIME ELAPSED │ ├──────────────────┼──────────────────────┼───────────┼──────────────────────────────────────────────────────────┼────────┼──────────────┤ │ google_workspace │ access_transparency │ pipeline │ (ingest pipeline warnings test-access-transparency.log) │ PASS │ 383.388417ms │ │ google_workspace │ access_transparency │ pipeline │ test-access-transparency.log │ PASS │ 96.73475ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-application.log) │ PASS │ 352.824625ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-calendar.log) │ PASS │ 382.384916ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-chat.log) │ PASS │ 362.333583ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-chromeos.log) │ PASS │ 342.498208ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-contacts.log) │ PASS │ 451.520666ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-delegatedadmin.log) │ PASS │ 326.118125ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-docs.log) │ PASS │ 337.687125ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-domain.log) │ PASS │ 352.338166ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-gmail.log) │ PASS │ 378.424583ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-groups.log) │ PASS │ 365.338917ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-licenses.log) │ PASS │ 367.061083ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-mobile.log) │ PASS │ 331.229625ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-org.log) │ PASS │ 358.463959ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-security.log) │ PASS │ 322.771875ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-sites.log) │ PASS │ 386.980084ms │ │ google_workspace │ admin │ pipeline │ (ingest pipeline warnings test-admin-user.log) │ PASS │ 357.295792ms │ │ google_workspace │ admin │ pipeline │ test-admin-application.log │ PASS │ 228.357833ms │ │ google_workspace │ admin │ pipeline │ test-admin-calendar.log │ PASS │ 278.169917ms │ │ google_workspace │ admin │ pipeline │ test-admin-chat.log │ PASS │ 113.188125ms │ │ google_workspace │ admin │ pipeline │ test-admin-chromeos.log │ PASS │ 449.799458ms │ │ google_workspace │ admin │ pipeline │ test-admin-contacts.log │ PASS │ 61.79025ms │ │ google_workspace │ admin │ pipeline │ test-admin-delegatedadmin.log │ PASS │ 183.655417ms │ │ google_workspace │ admin │ pipeline │ test-admin-docs.log │ PASS │ 130.585583ms │ │ google_workspace │ admin │ pipeline │ test-admin-domain.log │ PASS │ 1.502911s │ │ google_workspace │ admin │ pipeline │ test-admin-gmail.log │ PASS │ 236.055667ms │ │ google_workspace │ admin │ pipeline │ test-admin-groups.log │ PASS │ 337.411792ms │ │ google_workspace │ admin │ pipeline │ test-admin-licenses.log │ PASS │ 191.758708ms │ │ google_workspace │ admin │ pipeline │ test-admin-mobile.log │ PASS │ 602.900916ms │ │ google_workspace │ admin │ pipeline │ test-admin-org.log │ PASS │ 330.994542ms │ │ google_workspace │ admin │ pipeline │ test-admin-security.log │ PASS │ 504.510208ms │ │ google_workspace │ admin │ pipeline │ test-admin-sites.log │ PASS │ 139.586875ms │ │ google_workspace │ admin │ pipeline │ test-admin-user.log │ PASS │ 1.496036042s │ │ google_workspace │ alert │ pipeline │ (ingest pipeline warnings test-alert.log) │ PASS │ 378.6655ms │ │ google_workspace │ alert │ pipeline │ test-alert.log │ PASS │ 146.34425ms │ │ google_workspace │ chrome │ pipeline │ (ingest pipeline warnings test-chrome.log) │ PASS │ 334.966375ms │ │ google_workspace │ chrome │ pipeline │ test-chrome.log │ PASS │ 94.383917ms │ │ google_workspace │ context_aware_access │ pipeline │ (ingest pipeline warnings test-context-aware-access.log) │ PASS │ 355.900792ms │ │ google_workspace │ context_aware_access │ pipeline │ test-context-aware-access.log │ PASS │ 59.070125ms │ │ google_workspace │ device │ pipeline │ (ingest pipeline warnings test-device.log) │ PASS │ 352.477167ms │ │ google_workspace │ device │ pipeline │ test-device.log │ PASS │ 61.590125ms │ │ google_workspace │ drive │ pipeline │ (ingest pipeline warnings test-drive.log) │ PASS │ 363.087083ms │ │ google_workspace │ drive │ pipeline │ test-drive.log │ PASS │ 552.538834ms │ │ google_workspace │ gcp │ pipeline │ (ingest pipeline warnings test-gcp.log) │ PASS │ 385.564083ms │ │ google_workspace │ gcp │ pipeline │ test-gcp.log │ PASS │ 58.709333ms │ │ google_workspace │ group_enterprise │ pipeline │ (ingest pipeline warnings test-group-enterprise.log) │ PASS │ 326.525542ms │ │ google_workspace │ group_enterprise │ pipeline │ test-group-enterprise.log │ PASS │ 57.078959ms │ │ google_workspace │ groups │ pipeline │ (ingest pipeline warnings test-groups.log) │ PASS │ 375.430125ms │ │ google_workspace │ groups │ pipeline │ test-groups.log │ PASS │ 540.312291ms │ │ google_workspace │ login │ pipeline │ (ingest pipeline warnings test-login.log) │ PASS │ 321.579542ms │ │ google_workspace │ login │ pipeline │ test-login.log │ PASS │ 277.461875ms │ │ google_workspace │ rules │ pipeline │ (ingest pipeline warnings test-rules.log) │ PASS │ 352.129917ms │ │ google_workspace │ rules │ pipeline │ test-rules.log │ PASS │ 76.544708ms │ │ google_workspace │ saml │ pipeline │ (ingest pipeline warnings test-saml.log) │ PASS │ 384.585583ms │ │ google_workspace │ saml │ pipeline │ test-saml.log │ PASS │ 71.714417ms │ │ google_workspace │ token │ pipeline │ (ingest pipeline warnings test-token.log) │ PASS │ 359.402958ms │ │ google_workspace │ token │ pipeline │ test-token.log │ PASS │ 62.800125ms │ │ google_workspace │ user_accounts │ pipeline │ (ingest pipeline warnings test-user-accounts.log) │ PASS │ 365.416666ms │ │ google_workspace │ user_accounts │ pipeline │ test-user-accounts.log │ PASS │ 171.895333ms │ ╰──────────────────┴──────────────────────┴───────────┴──────────────────────────────────────────────────────────┴────────┴──────────────╯ --- Test results for package: google_workspace - END --- Done 

Related issues

• Relates: [Serverless security] [google_workspace] Failing test daily: pipeline test: test-chrome.log in google_workspace.chrome #12195
• Relates: [Serverless observability] [google_workspace] Failing test daily: pipeline test: test-chrome.log in google_workspace.chrome #12194

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[ShourieG]

LGTM, conflicts need resolved

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 53f1f6c2a2e848922880f64d65de54a536370e01

History

• 💚 Build #20613 succeeded b6c051151bc6fbaee2217df56e717a17478c6f4d

cc @kcreddy

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package google_workspace - 2.30.1 containing this change is available at https://epr.elastic.co/package/google_workspace/2.30.1/