o365: tolerate missing cursor elements when advancing

packages/o365/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.26.2"
+ changes:
+ - description: Tolerate missing cursor elements when advancing.
+ type: bugfix
+ link: https://github.com/elastic/integrations/pull/15154
 - version: "2.26.1"
  changes:
  - description: Ensure that cursors are not updated to times in the future.

packages/o365/data_stream/audit/agent/stream/cel.yml.hbs

@@ -456,8 +456,9 @@ program: |-
  (
  // Ensure that we bring the current type up to the current time,
  // even if we did not get any content for the query period.
- timestamp(state.cursor.last_for[state.work.curr_type.to_lower()]) < now - duration("1h") &&
- !state.work.todo_type.exists(t, t == state.work.curr_type)
+ has(state.?work.curr_type) && state.?cursor.last_for.optMap(l,
+ timestamp(l[state.work.curr_type.to_lower()]) < now - duration("1h")
+ ).orValue(false) && !state.work.todo_type.exists(t, t == state.work.curr_type)
  ) ?
  state.with(
  {

packages/o365/manifest.yml

@@ -1,6 +1,6 @@
 name: o365
 title: Microsoft Office 365
-version: "2.26.1"
+version: "2.26.2"
 description: Collect logs from Microsoft Office 365 with Elastic Agent.
 type: integration
 format_version: "3.2.3"