tines: make inputs object arrays flattened

[efd6]

What does this PR do?

Makes tines.audit_log.inputs.inputs.{agents,diagramNotes,links} object arrays flattened.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• @SpencerLN Can you confirm any documents with a non-empty tines.audit_log.inputs.inputs.agents array? It would be good to know that it is actually an array of object (this is not documented in the Tines docs)
• Can you confirm that we need to map standardLibVersion as a keyword. It looks like it may well be a number, but I'm being conservative here. Have you seen any non-numeric values? (also apparently not documented).

How to test this PR locally

Related issues

• Fixes Tines Integration Mapping Issues #5497

Screenshots

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-03-09T22:24:32.034+0000

• Duration: 15 min 42 sec

Test stats 🧪

Test	Results
Failed	0
Passed	12
Skipped	0
Total	12

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[SpencerLN]

@efd6, here is a sample document that has the inputs.inputs.agent field:

 { "created_at": "2023-03-01T18:10:03Z", "operation_name": "StoryItemsCreation", "id": 26088, "inputs": { "inputs": { "storyId": 125, "links": [ { "sourceIdentifier": "QW=", "receiverIdentifier": "Q=" } ], "agents": [ { "name": "Concat", "disabled": false, "position": { "x": -285, "y": 750 }, "options": "{\"mode\":\"message_only\",\"loop\":false,\"payload\":{\"data\":\"This is an automatically generated message from Tines\"}}", "schedule": null, "type": "eventTransformation", "timeSavedUnit": "minutes", "timeSavedValue": 0, "softDeletedId": 5213 } ], "diagramNotes": [] }, "liveEvents": null }, "request_ip": "8.8.8.8", "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36", "tenant_id": 1, "updated_at": "2023-03-01T18:10:03Z", "user_email": "user@email.com", "user_id": 7, "user_name": "First Last" } 

I took a look at our data and for our dataset, standardLibVersion is always an integer. That said, the Tines API returns it as a json string, so keeping it as a keyword may be safest to prevent any future issues.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (2/2)	💚
Files	100.0% (2/2)	💚 3.182
Classes	100.0% (2/2)	💚 3.182
Methods	91.304% (21/23)	👍 0.146
Lines	82.474% (160/194)	👎 -9.552
Conditionals	100.0% (0/0)	💚

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

Package tines - 0.0.4 containing this change is available at https://epr.elastic.co/search?package=tines