[kubernetes] Fix conditionals in fields rename in audit logs

[zmoog]

Proposed commit message

Fix conditionals to use the correct field before attempting a field rename operation.

The conditionals are checking the existence of the wrong field audit.stageTimestamp, so the rename processor fails with the "field [kubernetes.audit.stageTimestamp] already exists" error.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 95eb27f

History

• 💚 Build #35377 succeeded ebd0e26

cc @zmoog

[zmoog]

I ran a quick test on Kind and the integration seems to work correctly, I see no errors so far:

[elastic-vault-github-plugin-prod]

Package kubernetes - 1.82.1 containing this change is available at https://epr.elastic.co/package/kubernetes/1.82.1/