okta: do not remove event.original in main ingest#12127
Conversation
3ac0cfd to
006d383
Compare
🚀 Benchmarks reportTo see the full report comment with |
|
💚 Build Succeeded
History
cc @efd6 |
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
chrisberkhout
left a comment
There was a problem hiding this comment.
So if you provide an event with message and event.original, the event.original will be used and the message will be discarded.
Before this change it was the same, except the message field wouldn't be removed.
I the change is fine.
I wonder if we should be more consistent about using event.original as the source, and any other conventions necessary to make it easier to reprocess events.
I would like this. I think it's something that we should discuss for the integrations review document. |
|
Package okta - 3.4.0 containing this change is available at https://epr.elastic.co/package/okta/3.4.0/ |




Proposed commit message
See title.
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots