[elasticsearch] Fix audit event.outcome for security config changes

[consulthys]

Proposed commit message

Stop defaulting unmatched Elasticsearch audit actions to event.outcome: failure. Successful security_config_change events such as put_user were indexed as failures, which broke dashboards and detection rules. Map config-change targets to destination.user so actor attribution does not overwrite the affected user.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• event.outcome is success for security_config_change actions (put_user, change_password, put_role, delete_user, …)
• event.outcome remains failure for denied/failed authn/authz actions
• Unknown actions map to unknown, not failure
• Target user is destination.user.*; actor stays on user.name when present
• elasticsearch.audit.put / change / delete payloads are retained

How to test this PR locally

cd packages/elasticsearch
elastic-package stack up -d --services=elasticsearch
elastic-package test pipeline --data-streams audit -v --report-format human

If expected documents need a refresh after pipeline tweaks:

elastic-package test pipeline --data-streams audit --generate

elastic-package check (lint + build) passed locally. Pipeline tests were not executed here because Docker was not available.

Related issues

• Closes [Elasticsearch] The Audit ingest pipeline wrongfully populates success events with failure in event.outcome. #12163
• Relates Improve coverage of reported audit events beats#38549

cc @ebarlas

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

TL;DR

The failed Buildkite step (Check integrations elasticsearch) is caused by pipeline test expectation drift in the Elasticsearch audit data stream after changing event.outcome mapping logic. Regenerate and commit the audit pipeline expected documents for this PR.

Remediation

• Regenerate audit pipeline expected outputs and commit them:
  • cd packages/elasticsearch
  • elastic-package test pipeline --data-streams audit --generate
• Re-run the same package checks to confirm:
  • .buildkite/scripts/test_one_package.sh packages/elasticsearch origin/main 121f49a2e1a807c1e77ad55f79f25a5f56c952d7

Investigation details

Root Cause

The PR updates audit event outcome behavior for security config changes (e.g., put_user, change_password) and unknown actions, which changes pipeline output semantics. In packages/elasticsearch/data_stream/audit/elasticsearch/ingest_pipeline/default.yml the outcome is explicitly set in the script block (lines 34-44), so expected pipeline fixtures must match the new mapping.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/49036
• Job/step: Check integrations elasticsearch
• Key log excerpt:
  • --- [elasticsearch] failed
  • 🚨 Error: The command exited with status 1
  • user command error: exit status 1
• The log then uploads test artifacts including pipeline result XML (build/test-results/elasticsearch-pipeline-*.xml), consistent with a package test failure rather than infra failure.

Verification

• Not run locally in this environment (the failing CI artifacts are not present in workspace; only the summarized Buildkite log was available).

Follow-up

If regenerating expected outputs still fails, please share the uploaded elasticsearch-pipeline-*.xml artifact and the corresponding build/elastic-stack-dump/.../logs/*.log excerpts from this build so we can pinpoint the exact assertion delta.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: dca95b2

History

• 💔 Build #49036 failed 121f49a
• 💔 Build #49034 failed 68b1aa3