index call_stack_summary in API events

[jdu2600]

Change Summary

Add call_stack_summary to API events. This field is indexed for other event types.

For mapping changes:

• I ran make after making the schema changes, and committed all changes

[jdu2600]

Build failure appears unrelated (and presumably temporary).

Error response from daemon: manifest for docker.elastic.co/elasticsearch/elasticsearch:8.16.0 not found: manifest unknown: manifest unknown

[pzl]

LGTM, thanks for adding it to the sample_event.json, all good here

yes, the CI failure is unrelated. Just waiting for the rest of the stack to start making 8.16.0-SNAPSHOT images to test against.

[pzl]

@jdu2600 I don't think "\ci" is set up to run in this repo (I will try below), but if you push an update to trigger a rebuild, I expect CI should run correctly now

\ci

[jdu2600]

@pzl - is main currently healthy? The latest build is red...

When I commit just my changes (d94ae4c) the build fails with -

check for uncommitted build artifacts
100644 100644 205b29c771fe7a6ebac20bb30d218f8d52473522 0000000000000000000000000000000000000000 M	package/endpoint/data_stream/security/fields/fields.yml
100644 100644 9a14e79a25c6342d37edf5649f8b4489e5386ec4 0000000000000000000000000000000000000000 M	package/endpoint/docs/README.md
100644 100644 9d9c333ba063b7aa1f49fe06b8cc49c91e4269b5 0000000000000000000000000000000000000000 M	schemas/v1/security/security.yaml

And when I commit those unrelated changes (bb236c9) it then fails with -

endpoint/security Verify sample_event.json:
[0] field "Target.process.Ext.authentication_id" is undefined
[1] field "process.Ext.authentication_id" is undefined

My issue seems to be related to #519 but it's final build was green...

[pzl]

Good catch, main is not healthy. The PR CI was green, but on-merge was not.

Will clean up main and unblock

[jdu2600]

@pzl Thanks - all working now. 😃