zoom: clean-up

packages/zoom/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.18.1"
+  changes:
+    - description: Fix ingest pipeline conditional field handling.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/9077
 - version: 1.18.0
   changes:
     - description: ECS version updated to 8.11.0.

packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/account.yml

@@ -7,18 +7,23 @@ processors:
 - append:
     field: event.category
     value: configuration
-    if: "['account.settings_updated'].contains(ctx?.event?.action)"
+    if: ctx.event?.action == 'account.settings_updated'
 - append:
     field: event.type
     value: user
 - append:
     field: event.type
     value: creation
-    if: ctx?.event?.action == 'account.created'
+    if: ctx.event?.action == 'account.created'
 - append:
     field: event.type
     value: change
-    if: "['account.updated', 'account.settings_updated', 'account.disassociated'].contains(ctx?.event?.action)"
+    if: >-
+      [
+        'account.updated',
+        'account.settings_updated',
+        'account.disassociated'
+      ].contains(ctx.event?.action)
 - rename:
     field: zoom.account_id
     target_field: zoom.master_account_id
@@ -32,7 +37,7 @@ processors:
     target_field: '@timestamp'
     formats:
     - UNIX_MS
-    if: ctx?.zoom?.time_stamp != null
+    if: ctx.zoom?.time_stamp != null
     ignore_failure: true
 - rename:
     field: zoom.object
@@ -43,69 +48,69 @@ processors:
 #
 - set:
     field: user.target.id
-    value: '{{zoom.account.owner_id}}'
+    value: '{{{zoom.account.owner_id}}}'
     ignore_empty_value: true
 - set:
     field: user.target.email
-    value: '{{zoom.account.owner_email}}'
+    value: '{{{zoom.account.owner_email}}}'
     ignore_empty_value: true
 
 #
 # set user.target from old_values.account_* fields (updated account).
 #
 - set:
     field: user.target.id
-    value: '{{zoom.old_values.id}}'
-    if: 'ctx.zoom?.old_values?.id != null'
+    value: '{{{zoom.old_values.id}}}'
+    if: ctx.zoom?.old_values?.id != null
 - set:
     field: user.target.email
-    value: '{{zoom.old_values.account_email}}'
-    if: 'ctx.zoom?.old_values?.account_email != null'
+    value: '{{{zoom.old_values.account_email}}}'
+    if: ctx.zoom?.old_values?.account_email != null
 - set:
     field: user.target.full_name
-    value: '{{zoom.old_values.account_name}}'
-    if: 'ctx.zoom?.old_values?.account_name != null'
+    value: '{{{zoom.old_values.account_name}}}'
+    if: ctx.zoom?.old_values?.account_name != null
 - set:
     field: user.target.name
-    value: '{{zoom.old_values.account_alias}}'
-    if: 'ctx.zoom?.old_values?.account_alias != null'
+    value: '{{{zoom.old_values.account_alias}}}'
+    if: ctx.zoom?.old_values?.account_alias != null
 
 #
 # set user.changes from account.account_* fields (updated account).
 #
 - set:
     field: user.changes.id
-    value: '{{zoom.account.id}}'
-    if: 'ctx.zoom?.account?.id != null && ctx.zoom?.old_values?.id != ctx.zoom?.account?.id'
+    value: '{{{zoom.account.id}}}'
+    if: ctx.zoom?.account?.id != null && ctx.zoom?.old_values?.id != ctx.zoom?.account?.id
 - set:
     field: user.changes.email
-    value: '{{zoom.account.account_email}}'
-    if: 'ctx.zoom?.account?.account_email != null && ctx.zoom?.old_values?.account_email != ctx.zoom?.account?.account_email'
+    value: '{{{zoom.account.account_email}}}'
+    if: ctx.zoom?.account?.account_email != null && ctx.zoom?.old_values?.account_email != ctx.zoom?.account?.account_email
 - set:
     field: user.changes.full_name
-    value: '{{zoom.account.account_name}}'
-    if: 'ctx.zoom?.account?.account_name != null && ctx.zoom?.old_values?.account_name != ctx.zoom?.account?.account_name'
+    value: '{{{zoom.account.account_name}}}'
+    if: ctx.zoom?.account?.account_name != null && ctx.zoom?.old_values?.account_name != ctx.zoom?.account?.account_name
 - set:
     field: user.changes.name
-    value: '{{zoom.account.account_alias}}'
-    if: 'ctx.zoom?.account?.account_alias != null && ctx.zoom?.old_values?.account_alias != ctx.zoom?.account?.account_alias'
+    value: '{{{zoom.account.account_alias}}}'
+    if: ctx.zoom?.account?.account_alias != null && ctx.zoom?.old_values?.account_alias != ctx.zoom?.account?.account_alias
 
 #
 # Append to related.user array
 #
 - append:
     field: related.user
-    value: "{{zoom.account.owner_id}}"
+    value: "{{{zoom.account.owner_id}}}"
     allow_duplicates: false
     if: ctx.zoom?.account?.owner_id != null
 - append:
     field: related.user
-    value: "{{user.target.id}}"
+    value: "{{{user.target.id}}}"
     allow_duplicates: false
     if: ctx.user?.target?.id != null
 - append:
     field: related.user
-    value: "{{user.changes.id}}"
+    value: "{{{user.changes.id}}}"
     allow_duplicates: false
     if: ctx.user?.changes?.id != null
 

packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/chat_channel.yml

@@ -4,19 +4,24 @@ processors:
 - append:
     field: event.type
     value: user
-    if: "['chat_channel.member_invited', 'chat_channel.member_joined', 'chat_channel.member_left'].contains(ctx?.event?.action)"
+    if: >-
+      [
+        'chat_channel.member_invited',
+        'chat_channel.member_joined',
+        'chat_channel.member_left'
+      ].contains(ctx.event?.action)
 - append:
     field: event.type
     value: creation
-    if: ctx?.event?.action == 'chat_channel.created'
+    if: ctx.event?.action == 'chat_channel.created'
 - append:
     field: event.type
     value: deletion
-    if: ctx?.event?.action == 'chat_channel.deleted'
+    if: ctx.event?.action == 'chat_channel.deleted'
 - append:
     field: event.type
     value: change
-    if: ctx?.event?.action == 'chat_channel.updated'
+    if: ctx.event?.action == 'chat_channel.updated'
 - rename:
     field: zoom.object
     target_field: zoom.chat_channel
@@ -26,30 +31,30 @@ processors:
     target_field: '@timestamp'
     formats:
     - UNIX_MS
-    if: ctx?.zoom?.chat_channel?.timestamp != null
+    if: ctx.zoom?.chat_channel?.timestamp != null
     ignore_failure: true
 - remove:
     field: zoom.chat_channel.date_time
     ignore_missing: true
-    if: ctx?.zoom?.chat_channel?.timestamp != null
+    if: ctx.zoom?.chat_channel?.timestamp != null
 - date:
     field: zoom.chat_channel.date_time
     target_field: '@timestamp'
     formats:
     - ISO_INSTANT
-    if: "ctx?.zoom?.chat_channel?.date_time != null && ctx?.zoom?.chat_channel?.timestamp == null"
+    if: ctx.zoom?.chat_channel?.date_time != null && ctx.zoom?.chat_channel?.timestamp == null
     ignore_failure: true
 - remove:
     field: zoom.chat_channel.timestamp
     ignore_missing: true
-    if: ctx?.zoom?.chat_channel?.timestamp != null
+    if: ctx.zoom?.chat_channel?.timestamp != null
 - foreach:
     field: zoom.chat_channel.members
     ignore_missing: true
     processor:
       append:
         field: related.user
-        value: ["{{_ingest._value.display_name}}", "{{_ingest._value.id}}"]
+        value: ["{{{_ingest._value.display_name}}}", "{{{_ingest._value.id}}}"]
         allow_duplicates: false
 # Removing to prevent nested values, added to related.user above
 - remove:

packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/chat_message.yml

@@ -7,46 +7,46 @@ processors:
 - append:
     field: event.type
     value: creation
-    if: ctx?.event?.action == 'chat_message.sent'
+    if: ctx.event?.action == 'chat_message.sent'
 - append:
     field: event.type
     value: deletion
-    if: ctx?.event?.action == 'chat_message.deleted'
+    if: ctx.event?.action == 'chat_message.deleted'
 - append:
     field: event.type
     value: change
-    if: ctx?.event?.action == 'chat_message.updated'
+    if: ctx.event?.action == 'chat_message.updated'
 - rename:
     field: zoom.object
     target_field: zoom.chat_message
     ignore_missing: true
 - append:
     field: related.user
-    value: "{{zoom.chat_message.contact_id}}"
-    if: "ctx?.zoom?.chat_message?.contact_id != null"
+    value: "{{{zoom.chat_message.contact_id}}}"
+    if: ctx.zoom?.chat_message?.contact_id != null
 - date:
     field: zoom.chat_message.timestamp
     target_field: '@timestamp'
     formats:
     - UNIX_MS
-    if: ctx?.zoom?.chat_message?.timestamp != null
+    if: ctx.zoom?.chat_message?.timestamp != null
     ignore_failure: true
 - remove:
     field: zoom.chat_message.date_time
     ignore_missing: true
-    if: ctx?.zoom?.chat_message?.timestamp != null
+    if: ctx.zoom?.chat_message?.timestamp != null
 - date:
     field: zoom.chat_message.date_time
     target_field: '@timestamp'
     formats:
     - ISO_INSTANT
-    if: ctx?.zoom?.chat_message?.timestamp == null
+    if: ctx.zoom?.chat_message?.timestamp == null
     ignore_failure: true
 - remove:
     field: zoom.chat_message.timestamp
     ignore_missing: true
 - remove:
-    if: ctx?.zoom?.chat_message?.message == null
+    if: ctx.zoom?.chat_message?.message == null
     field: zoom.chat_message.message
     ignore_missing: true
 on_failure:

packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/default.yml

@@ -60,19 +60,19 @@ processors:
       ignore_missing: true
   - append:
       field: related.user
-      value: "{{zoom.operator_id}}"
-      if: "ctx.zoom?.operator_id != null"
+      value: "{{{zoom.operator_id}}}"
+      if: ctx.zoom?.operator_id != null
   # Set user.id from operator data (user who performs an action).
   - set:
       field: user.id
-      value: "{{zoom.operator_id}}"
-      if: "ctx.zoom?.operator_id != null"
+      value: "{{{zoom.operator_id}}}"
+      if: ctx.zoom?.operator_id != null
   # Set user.name from operator data only when user.id also set above.
   - set:
       field: user.email
-      value: "{{zoom.operator}}"
+      value: "{{{zoom.operator}}}"
       ignore_empty_value: true
-      if: "ctx.zoom?.operator_id != null"
+      if: ctx.zoom?.operator_id != null
   # Removing some fields that have complex nested arrays that might impact performance
   - remove:
       field:
@@ -94,31 +94,31 @@ processors:
       ignore_missing: true
   - pipeline:
       name: '{{ IngestPipeline "meeting" }}'
-      if: "ctx?.event?.action.startsWith('meeting')"
+      if: ctx.event?.action?.startsWith('meeting') == true
   - pipeline:
       name: '{{ IngestPipeline "account" }}'
-      if: "ctx?.event?.action.startsWith('account')"
+      if: ctx.event?.action?.startsWith('account') == true
   - pipeline:
       name: '{{ IngestPipeline "chat_message" }}'
-      if: "ctx?.event?.action.startsWith('chat_message')"
+      if: ctx.event?.action?.startsWith('chat_message') == true
   - pipeline:
       name: '{{ IngestPipeline "chat_channel" }}'
-      if: "ctx?.event?.action.startsWith('chat_channel')"
+      if: ctx.event?.action?.startsWith('chat_channel') == true
   - pipeline:
       name: '{{ IngestPipeline "phone" }}'
-      if: "ctx?.event?.action.startsWith('phone')"
+      if: ctx.event?.action?.startsWith('phone') == true
   - pipeline:
       name: '{{ IngestPipeline "recording" }}'
-      if: "ctx?.event?.action.startsWith('recording')"
+      if: ctx.event?.action?.startsWith('recording') == true
   - pipeline:
       name: '{{ IngestPipeline "user" }}'
-      if: "ctx?.event?.action.startsWith('user')"
+      if: ctx.event?.action?.startsWith('user') == true
   - pipeline:
       name: '{{ IngestPipeline "webinar" }}'
-      if: "ctx?.event?.action.startsWith('webinar')"
+      if: ctx.event?.action?.startsWith('webinar') == true
   - pipeline:
       name: '{{ IngestPipeline "zoomroom" }}'
-      if: "ctx?.event?.action.startsWith('zoomroom')"
+      if: ctx.event?.action?.startsWith('zoomroom') == true
 on_failure:
   - set:
       field: event.kind