Description

This PR implements a bug fix for the Update Rule API used in rule-based auto-tagging.

Previously, if a rule had two attributes and an update request was sent with only one attribute, both existing attributes would be replaced. With this fix, only the specified attribute will be updated, while the others remain unchanged.

For example,
the previous rule is

{
  "description": "test1",
  "principal": {"username": ["alice"]},"index_pattern": ["my-index"],
  "workload_group": "x5_wjV3lRjWRO5tG1fydgw"
}'

and we only update the field index_pattern, the result will still have the original principal entry

{
  "description": "test1",
  "index_pattern": ["my-indexxx"],
  "workload_group": "x5_wjV3lRjWRO5tG1fydgw"
}'

{"id":"83e89252-7d30-30ab-8e07-082817115c08","description":"test1","index_pattern":["my-indexxx"],"principal":{"username":["alice"]},"workload_group":"x5_wjV3lRjWRO5tG1fydgw","updated_at":"2025-10-01T21:38:45.397891Z"}%     

Related Issues

Resolves #[Issue number to be closed when this PR is merged]

Check List

• Functionality includes testing.
• API changes companion pull request created, if applicable.
• Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.