[Agentless Integrations] Agentless integrations 'organization' field pipeline failure

Pipeline failure is:

Processor 'rename' with tag '' failed with message 'cannot set [id] with parent object of type [java.lang.String] as part of path [organization.id]'

Where the field causing the failure is organization below:

"division": "engineering",
"organization": "security",
"team": "security-service-integrations",

Agentless policies add the division, organization, and team as global data tags:

Global data tags get injected via add_fields processors when the policy is created:

Until this will be fixed in elastic/kibana#221312, a workaround should be applied in the current agentless integrations simialr to #14056

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

Navigation Menu