checkpoint_harmony_endpoint: fix typo when calculating next start time

[chemamartinez]

Proposed commit message

Fix a typo that avoids reading properly the last timestamp from received data, as the incoming JSON body contains an array called records instead of results.

Note

All data streams have identical cel.yml.hbs files.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[chrisberkhout]

This fix avoids assuming we've seen everything from the requested range. The end of the requested range may have some data that wasn't ready this time but will be visible next time.

I think it would be good to also adjust the other place this is relevant: the Done case.

diff --git a/packages/checkpoint_harmony_endpoint/data_stream/antibot/agent/stream/cel.yml.hbs b/packages/checkpoint_harmony_endpoint/data_stream/antibot/agent/stream/cel.yml.hbs
index 86b1c631a0..71ce9bfa4e 100644
--- a/packages/checkpoint_harmony_endpoint/data_stream/antibot/agent/stream/cel.yml.hbs
+++ b/packages/checkpoint_harmony_endpoint/data_stream/antibot/agent/stream/cel.yml.hbs
@@ -169,20 +169,21 @@ program: |
   					: (body.data.state == "Done") ?
   						// 'Done' (Results empty) - Clear the task ID and end the sequence.
   						state.with(
   							{
   								"events": [],
   								"want_more": false,
   								"cursor": state.cursor.with(
   									{
   										"auth_data": auth_data,
   										"task_id": null,
+  										"next_startTime": state.cursor.current_startTime,
   									}
   								),
   							}
   						)
   					: (body.data.state == "Canceled") ?
   						// 'Canceled' (Error or timeout) - Clear the task ID and reset the sequence for the same timeframe.
   						state.with(
   							{
   								"events": [],
   								"want_more": false,

What do you think?

[chemamartinez]

What do you think?

Yeah, that makes sense and it is harmless for other cases when receiving Done. I've added it at 3be6421.

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 3be6421

History

• 💚 Build #24986 succeeded fd2a4fc

cc @chemamartinez

[elastic-vault-github-plugin-prod]

Package checkpoint_harmony_endpoint - 0.7.1 containing this change is available at https://epr.elastic.co/package/checkpoint_harmony_endpoint/0.7.1/